fix(quiz): cap question count at 20 and rate-limit /api/quiz/generate to 10 requests per minute - #293
Conversation
… to 10/min
/api/quiz/generate had no upper bound on the 'count' parameter and no rate
limiting. Any caller could pass count=100000 or make unlimited concurrent
requests, exhausting the project's Groq API quota within seconds.
Changes:
- Added Flask-Limiter dependency (3.5.0) to requirements.txt.
- Wired a per-IP Limiter instance to the Flask app using in-memory storage.
- Added MAX_QUIZ_QUESTIONS = 20 constant. Both the JSON and form-data code
paths now call min(int(count), MAX_QUIZ_QUESTIONS) before passing count
to the LLM prompt.
- Applied @limiter.limit('10 per minute') decorator to generate_quiz so a
single IP cannot exhaust Groq quota through rapid requests.
Closes mugenkyou#290
github-actions
Bot
added
awaiting review
enhancement
📥 Pull Request ReceivedThank you for your contribution to College Daddy. Your pull request has been received and is currently under review. 🔗 Linked Issues
✅ Pre-Merge ChecklistPlease ensure the following requirements are met:
👤 Reviewer Assigned@mugenkyou has been assigned to review this pull request. Our team will review your submission shortly. We appreciate your effort in improving the platform for students. |
|
Hi @mugenkyou, a gentle follow-up on this PR. It has been 2 days since any activity. There are no merge conflicts. Please review when you have a moment. Happy to address any feedback. |
🎉 Pull Request Merged SuccessfullyContributor: @anshul23102 Your pull request has been successfully merged into the main codebase. Thank you for your valuable contribution to College Daddy. 🚀 Next StepsWe encourage you to:
We value your commitment to improving educational technology and look forward to your continued involvement. |
2 participants
Pull Request Summary
The
/api/quiz/generateendpoint had no upper bound on thecountparameter and no rate limiting. A caller could sendcount=100000to a single request, forcing the Groq LLM to attempt an enormous quiz and exhausting all available tokens in one call. Combined with unlimited concurrent requests, this could drain the project's Groq API quota within seconds and block the feature for all users.Fixes #290
Changes Introduced
app.py: AddedFlask-Limiterimport and wired a per-IPLimiterinstance to the Flask app using in-memory storage with no global default limit so only explicitly decorated routes are throttled.app.py: AddedMAX_QUIZ_QUESTIONS = 20constant. Both the JSON body and multipart form-data code paths now clampcountwithmin(int(count), MAX_QUIZ_QUESTIONS)before the value reaches the LLM prompt.app.py: Applied@limiter.limit("10 per minute")decorator togenerate_quizto throttle per-IP request volume.requirements.txt: AddedFlask-Limiter==3.5.0.Screenshots / Demo (for UI changes)
Not applicable. This is a backend change with no UI impact.
Checklist
Additional Notes
The rate limit (
10/min per IP) and the question cap (MAX_QUIZ_QUESTIONS = 20) are both constants that can be adjusted without touching any other code. The in-memory storage backend is appropriate for a single-process deployment; if the app scales horizontally a Redis URI can be passed tostorage_uriwithout any other changes.Could you please add the appropriate NSoC '26 label to this PR? It helps with tracking and scoring under NSoC '26. Thank you!