When check_rate is called for the first time, it's expected that ms_to_next_bucket would be qual to scale_ms, but that's not the case at the moment due to:
Utils.stamp_key/2 is currently creating a variable bucket key for the same ID and scale_ms. The bucket key changes every scale_ms milliseconds.
Redis/ETS backends are not expiring the bucket key after scale_ms, instead they rely that a new key is provided (1)
This bug allows check_rate to be called 2x in sequence even if the bucket limit is 1 attempt per hour. Both calls could receive :allow if timed when the bucket is about to expire (see how to reproduce the bug below).
Problem
When
check_rate
is called for the first time, it's expected thatms_to_next_bucket
would be qual toscale_ms
, but that's not the case at the moment due to:Utils.stamp_key/2
is currently creating a variable bucket key for the same ID andscale_ms
. The bucket key changes everyscale_ms
milliseconds.scale_ms
, instead they rely that a new key is provided (1)This bug allows check_rate to be called 2x in sequence even if the bucket limit is 1 attempt per hour. Both calls could receive
:allow
if timed when the bucket is about to expire (see how to reproduce the bug below).How to reproduce the bug
Proposed solution
This PR fixes this issue by:
Utils.stamp_key/2
for the same bucket ID andscale_ms
scale_ms
. I will open a PR onhammer-backend-redis
if this PR is accepted: https://github.com/nash-io/hammer-backend-redis/pull/1