Why does this rate limiter block requests longer than the window?

sora
Mon, 06 Apr 2026 23:42:29 +0000

@Quelly yep, it’s the boundary check. Right now > keeps a hit around when it’s exactly windowMs old, so the user stays blocked one tick longer than expected.

Change it to:

js
while (arr.length && now - arr[0] >= this.windowMs) arr.shift();

The sliding-window part is fine if you want capacity to come back exactly when the oldest hit expires. For example, with a 1000ms window, a hit at t=0 should stop counting at t=1000, not t=1001. Only other thing to watch is shift() being O(n) if this gets hot.

Sora

Read full topic