{
  "id": 18222536,
  "title": "This rate limit says 10 per minute. It let 20 through in 6 seconds.",
  "url": "https://urgent.news/2026/11/05/this-rate-limit-says-10-per-minute-it-let-20-through-in-6-seconds",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-05T01:30:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/haiduc0147/this-rate-limit-says-10-per-minute-it-let-20-through-in-6-seconds-5eej"
  },
  "original_language": "en",
  "account": "The rate limit permits ten requests per minute. In a scenario where twenty requests are sent within six seconds, all of them are allowed through. This behavior is typical of a common rate limiter.\n\nA fixed window limiter functions by dividing time into equal intervals, or \"windows,\" and counting the number of requests made within each window. When a new minute begins, the count resets to zero. The provided code demonstrates this approach, where the count is incremented for each request and compared against a threshold of ten. If the count exceeds ten, the request is rejected.\n\nHowever, this method can lead to suboptimal performance under certain conditions. In the source example, two bursts of ten requests are sent within a six-second period. Despite the rate limit of ten requests per minute, all twenty requests are successfully processed due to the reset of the count at the start of a new minute. This discrepancy arises because the fixed window limiter only considers the requests within the current minute, disregarding any requests from previous windows. Consequently, the server becomes overwhelmed, resulting in potential performance issues.\n\nTo mitigate this issue, an alternative approach known as the sliding log limiter can be employed. Instead of resetting the count at the start of each minute, the sliding log limiter maintains a record of all allowed requests within the last 60 seconds. Each time a request is made, the timestamps of the allowed requests are compared against the current time. If the number of requests within the last 60 seconds exceeds the limit, the request is rejected. Otherwise, the timestamp of the current request is added to the log, and the request is allowed.\n\nThe sliding log limiter provides a more accurate and fair enforcement of the rate limit. By considering the requests within a sliding time window rather than a fixed window, it ensures that bursts of requests are appropriately managed. In the provided example, the sliding log limiter would reject the additional ten requests, allowing only ten requests within the 60-second window. This approach helps prevent overloading the server and maintains a more balanced distribution of requests over time.\n\nWhile the sliding log limiter offers improved performance, it comes with the trade-off of increased memory usage. The limiter needs to store timestamps for every allowed request within the sliding window. For scenarios with high request volumes or a large number of users, this can result in a significant amount of data being stored. In contrast, the fixed window limiter maintains a simpler counter per user, consuming less memory.\n\nIn practice, limiter implementations often strike a balance between memory usage and performance. Some limiter variants, such as the sliding window counter, keep track of only two numbers: the count for the current minute and the count for the previous minute. By using these two values and estimating the request rate, they achieve a more efficient solution compared to maintaining a complete record of every request. Additionally, token bucket algorithms allow for intentional permitting of short bursts while still capping the average rate.\n\nThe choice of rate limiting algorithm depends on the specific requirements of the system, considering factors such as the desired level of fairness, memory constraints, and the nature of the traffic being managed. The fixed window limiter provides simplicity and ease of implementation, whereas the sliding log limiter offers a more robust and accurate enforcement of rate limits. Understanding the trade-offs and characteristics of each approach is crucial in selecting the most appropriate solution for a given scenario.",
  "summary": "A rate limit of 10 requests per minute. Someone sends 10 requests at 0:57, then 10 more at 1:00. All 20 get through, in under 6 seconds. Nothing is broken. This is how the most common rate limiter works. How a fixed window works The simplest limiter cuts time into minutes and counts requests in each one. 12:00 to 12:01 is one window, 12:01 to 12:02 is the next. When a new minute starts, the count…",
  "key_points": [
    "Rate limit allows 10 requests per minute",
    "20 requests processed in 6 seconds",
    "Sliding log limiter rejects excess requests"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}