AnonRateThrottle in Django REST framework

Using Django
1

Hi there! I’ve been experimenting with throttling in DRF, and I noticed that rest_framework.throttling.AnonRateThrottle does not work as I was expecting. Does this throttle class limit nonauthenticated users? The following configuration described in DRF docs does work well for authenticated users, but it does not rate limit anonymous users:

REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.AnonRateThrottle',
        'rest_framework.throttling.UserRateThrottle'
    ],
    'DEFAULT_THROTTLE_RATES': {
        'anon': '100/day',
        'user': '1000/day'
    }
}

Am I missing something? Thanks!

2

That looks correct to me. How are you testing this and what results are you seeing?

Take a look at the DRF source code and how it generates the unique ID for the anonymous user. It’s possible your test case is being considered unique anonymous users.