The Enterprise NAT Rate-Limit Block
#backend-critical — $2M client locked out by IP-based rate limiter
VP Sales: 5,000 Acme Corp employees getting 429 Too Many Requests. All traffic routes through corporate NAT IP 203.0.113.50 — request #101 blocked the entire enterprise.
The trap: Rate limiting by IP treats thousands of legitimate users behind a NAT gateway as a single attacker.
Your task
Fix `get_rate_limit_key()` in `rate_limiter.py`: extract user_id from JWT when authenticated, fall back to IP for unauthenticated endpoints.
Book: rate-limit by IP · Prod: enterprise NAT = one IP, thousands of users.
Skills you'll prove
Interview Tip
When asked about API rate limiting or DDoS protection, say: "The biggest mistake with rate limiting is keying on IP address alone. In production, enterprise clients, universities, and mobile carriers route thousands of users through a single NAT gateway — so IP-based limiting treats your biggest customer as a single attacker. I implement identity-based rate limiting: extract user_id from the JWT or API key and rate-limit per authenticated user. IP-based limiting is only appropriate for unauthenticated endpoints like login. I learned this the hard way when our $2M enterprise client was completely locked out at 9 AM because 5,000 employees shared one public IP and hit request 101 together."