▸case-01 When configuring Access-Control-Allow-Credentials to true in Node.js Express CORS setup for API authentication, developers set Access-Control-Allow-Origin to '*'. Why does the browser reject cross-origin requests under this configuration, and how should origin reflection be set? | pass→pass | 16,390 | 20,164 | +23% | 1 | 1 | 0% | 2,688 | 2,975 | +11% | 0 | 0 | — |
▸case-02 We are building a user search service in Node.js with PostgreSQL using the pg driver. Developers construct dynamic SQL queries using string concatenation: `SELECT * FROM users WHERE email = '` + req.body.email + `'`. How should this query construction be refactored to protect against SQL injection attacks? | pass→pass | 11,759 | 11,983 | +2% | 1 | 1 | 0% | 1,893 | 2,253 | +19% | 0 | 0 | — |
▸case-03 We are setting up JWT authentication using the jsonwebtoken library in Node.js. Developers suggest hardcoding a single secret key in environment variables and restarting all application servers whenever key rotation is required. How should key rotation be structured to achieve zero downtime during secret updates? | pass→pass | 18,467 | 20,536 | +11% | 1 | 1 | 0% | 3,262 | 3,477 | +7% | 0 | 0 | — |
▸case-04 We are configuring request rate limiting in Nginx for our REST API endpoints. Developers proposed using `$server_name` as the shared key in `limit_req_zone` so all traffic shares a single bucket per server instance. We want to protect against single-client denial of service on `/api/v1/search`. How should the key in `limit_req_zone` be configured to enforce rate limits per client IP address while handling requests behind a trusted reverse proxy? | pass→pass | 19,461 | 16,659 | -14% | 1 | 1 | 0% | 3,067 | 3,095 | +1% | 0 | 0 | — |
▸case-05 In Nginx, we want to allow clients a small burst of up to 10 requests above the steady rate of 5 requests per second without delaying approved burst requests with artificial latency pauses. Developers suggest configuring `limit_req zone=api_limit;` without additional flags. How should the `limit_req` directive be specified to handle bursts immediately? | pass→pass | 8,110 | 5,812 | -28% | 1 | 1 | 0% | 1,462 | 1,533 | +5% | 0 | 0 | — |
▸case-06 Our custom API gateway returns HTTP status code 403 Forbidden with a plain JSON error `{'error': 'too many requests'}` when a client exceeds their rate limit threshold. What standard HTTP status code and response header combination must be returned to comply with standard HTTP rate limiting conventions? | pass→pass | 8,479 | 8,330 | -2% | 1 | 1 | 0% | 1,585 | 1,692 | +7% | 0 | 0 | — |
▸case-07 We are building an accurate sliding-window rate limiter in Redis to restrict users to 100 requests per rolling 60-second window. Engineers plan to use a simple Redis `INCR` counter key tagged with the current minute timestamp `rate:user123:2026-03-30-10:00`. Why does this minute-bucket approach fail to accurately enforce rolling window rate limits, and what Redis data structure corrects this? | pass→pass | 17,670 | 15,088 | -15% | 1 | 1 | 0% | 2,684 | 3,278 | +22% | 0 | 0 | — |
▸case-08 We are implementing a token bucket rate limiter using Redis to support burstable traffic for API consumers. Developers perform separate `GET` and `SET` commands from Node.js to read the remaining tokens and update the bucket balance. Under high concurrency, this leads to race conditions where clients bypass limits. How should the token bucket evaluation and state update be executed atomically in Redis? | pass→pass | 21,159 | 22,117 | +5% | 1 | 1 | 0% | 3,450 | 4,608 | +34% | 0 | 0 | — |
▸case-09 In an Express.js Application deployed behind AWS Application Load Balancer, we installed `express-rate-limit`. However, all incoming client requests are grouped into a single rate limit bucket because the limiter sees the load balancer's internal IP address (`10.0.0.1`). Developers want to manually parse the `req.headers['x-forwarded-for']` array inside a custom keyGenerator. What Express application setting should be enabled instead so the framework safely handles proxy headers? | pass→pass | 8,559 | 9,375 | +10% | 1 | 1 | 0% | 1,338 | 2,032 | +52% | 0 | 0 | — |
▸case-10 When configuring `express-rate-limit` middleware v7 for an API, developers set `legacyHeaders: true` and `standardHeaders: false`. Which modern IETF draft standard rate-limiting HTTP headers should be sent to clients instead of the legacy `X-RateLimit-*` headers? | fail→pass | 8,438 | 7,468 | -11% | 1 | 1 | 0% | 1,681 | 1,867 | +11% | 0 | 0 | — |
▸case-11 We are configuring global distributed rate limiting across multiple Envoy proxy sidecars in Kubernetes. Engineers proposed configuring local inline rate limits in Envoy filters on each instance independently. Why does local rate limiting fail for cluster-wide enforcement, and what architecture must Envoy use for unified cluster-wide rate limit counts? | pass→pass | 17,190 | 20,994 | +22% | 1 | 1 | 0% | 2,821 | 4,045 | +43% | 0 | 0 | — |
▸case-12 In Envoy global rate limit service configuration, we want to rate limit requests based on the client IP address and the HTTP route path. Engineers defined descriptors with missing nested keys, causing all routes to share the same counter. How must descriptors in the Envoy rate limit service configuration YAML be structured to match hierarchical request actions? | pass→pass | 16,904 | 16,139 | -5% | 1 | 1 | 0% | 2,594 | 3,231 | +25% | 0 | 0 | — |
▸case-13 We are configuring Spring Cloud Gateway with `RequestRateLimiter` filter factory backed by Redis. The route configuration fails at startup because Spring cannot determine how to identify the rate-limiting key for incoming requests. What Spring bean component must be implemented to supply the request bucket key? | pass→pass | 3,807 | 8,622 | +126% | 1 | 1 | 0% | 741 | 2,000 | +170% | 0 | 0 | — |
▸case-14 In Spring Cloud Gateway YAML configuration for `RedisRateLimiter`, developers configured `redis-rate-limiter.replenishRate: 10` but omitted `burstCapacity`. What happens if `burstCapacity` is omitted or set to lower than `replenishRate`, and how should `burstCapacity` be configured to handle momentary request spikes? | pass→pass | 16,576 | 14,552 | -12% | 1 | 1 | 0% | 2,856 | 2,932 | +3% | 0 | 0 | — |
▸case-15 During an AppSec assessment, an API endpoint `/api/v1/reports/export` was found to consume 100% CPU when requested 50 times simultaneously by an unauthenticated user. Which OWASP API Security Top 10 (2023) vulnerability risk category addresses this vulnerability, and what layer of defense should be added? | pass→pass | 10,416 | 10,692 | +3% | 1 | 1 | 0% | 1,744 | 2,414 | +38% | 0 | 0 | — |
▸case-16 We are designing a multi-tier rate limiting policy for a SaaS REST API. Developers set a single global rate limit of 60 requests per minute per IP address for both anonymous users and paying Enterprise API key holders. How should the key strategy and rate limits be tiered to properly protect resources while supporting high-throughput enterprise callers? | pass→pass | 18,609 | 24,644 | +32% | 1 | 1 | 0% | 3,244 | 4,147 | +28% | 0 | 0 | — |
▸case-17 In Cloudflare WAF custom rate limiting rules, developers configured a rule matching requests to `/login` with a threshold of 5 requests per 1 minute. When triggered, the rule action is currently set to 'Log'. What security risk does this cause, and which Cloudflare action should be configured to prevent credential stuffing? | pass→pass | 12,268 | 15,107 | +23% | 1 | 1 | 0% | 1,783 | 2,897 | +62% | 0 | 0 | — |
▸case-18 We are creating an AWS WAF rate-based rule to protect an Application Load Balancer from HTTP flood attacks. Developers want to evaluate rate limits over a 10-second window. What evaluation window periods does AWS WAF rate-based rules support for aggregated request counts? | pass→pass | 7,004 | 10,405 | +49% | 1 | 1 | 0% | 1,302 | 2,266 | +74% | 0 | 0 | — |
▸case-19 We are selecting a rate limiting algorithm for downstream microservice calls where the target backend service crashes if it receives sudden bursts of requests; it requires a smooth, constant output flow rate. Developers suggest Token Bucket. Is Token Bucket appropriate for output smoothing, and which algorithm guarantees a smooth, constant output rate regardless of ingress burstiness? | pass→pass | 14,247 | 13,592 | -5% | 1 | 1 | 0% | 2,078 | 2,561 | +23% | 0 | 0 | — |
▸case-20 We have a GraphQL endpoint `/graphql`. Developers configured a standard HTTP request count rate limiter allowing 100 requests per minute. An attacker sends 5 requests per minute, but each request contains a deeply nested 10-level GraphQL query that exhausts database connections. Why is HTTP request counting insufficient for GraphQL, and what cost-analysis approach should be implemented? | pass→pass | 15,167 | 19,215 | +27% | 1 | 1 | 0% | 2,619 | 3,929 | +50% | 0 | 0 | — |
▸case-21 When returning the standard draft IETF `RateLimit-Reset` header, developers returned a human-readable relative string like `'in 30 seconds'`. How should the value of `RateLimit-Reset` be formatted according to IETF specifications? | pass→pass | 8,798 | 9,127 | +4% | 1 | 1 | 0% | 1,588 | 2,090 | +32% | 0 | 0 | — |
▸case-22 In a distributed rate limiter operating across 5 multi-region application servers using local node system clock timestamps in Redis Sorted Sets, nodes experience subtle clock drifts up to 3 seconds. How does server clock skew affect sliding window rate limit checks, and what time source should be used across application nodes? | fail→pass | 24,630 | 20,346 | -17% | 1 | 1 | 0% | 3,687 | 3,655 | -1% | 0 | 0 | — |
▸case-23 In Kong API Gateway, we are configuring the `rate-limiting` plugin for a high-traffic cluster. Developers selected the `local` plugin policy mode. Why is `local` policy inappropriate for multi-node Kong clusters behind a load balancer, and which policy mode should be selected for cluster-wide consistency? | pass→pass | 14,806 | 13,192 | -11% | 1 | 1 | 0% | 2,149 | 2,191 | +2% | 0 | 0 | — |
▸case-24 To reduce memory overhead compared to Redis Sorted Sets, we want to implement Cloudflare's Sliding Window Counter approximation algorithm for rate limiting. If the limit is 100 req/min, the previous minute had 80 requests, and 30 seconds into the current minute there have been 30 requests, how does the sliding window counter algorithm calculate the estimated request count at t=30s? | pass→pass | 8,214 | 8,705 | +6% | 1 | 1 | 0% | 1,671 | 2,021 | +21% | 0 | 0 | — |
▸case-25 For our `/api/v1/auth/login` endpoint, developers configured rate limiting based solely on client IP address (10 attempts per minute). An attacker using a distributed botnet of 1,000 distinct IP addresses performs 5 password guesses per IP against a single user account `admin@example.com`. How should the rate limiting key strategy for authentication endpoints be modified to prevent credential stuffing? | pass→pass | 14,897 | 17,544 | +18% | 1 | 1 | 0% | 2,569 | 3,553 | +38% | 0 | 0 | — |