[BUG] Token-limiter resets the Redis TTL on every increment, so the time-window never resets under sustained traffic

[Aias00]

• severity: High
• files: shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-token-limiter/src/main/java/org/apache/shenyu/plugin/ai/token/limiter/AiTokenLimiterPlugin.java:177-183
• description: recordTokensUsage does opsForValue().increment(cacheKey, tokens).flatMap(currentValue -> reactiveRedisTemplate.expire(cacheKey, Duration.ofSeconds(windowSeconds))).subscribe(). Because expire is re-issued after every increment, as long as requests keep arriving within windowSeconds the key never expires and the counter is never reset. The intended "token budget N per window" becomes a monotonic lifetime cap.
• impact: Time-window token quotas do not reset on schedule; sustained traffic gets permanently throttled until a quiet period.
• suggested_fix: Set the TTL only on key creation (e.g. INCR then EXPIRE NX, or a small lua that sets expiry only when EXISTS is false).
• confidence: High
• related_existing: none — [BUG] AI token limiter rule fields can be null and crash request processing #6513/[BUG] AI token limiter Redis key ignores rule and selector scope #6514/[BUG] AI token limiter can miss usage from gzip responses split across buffers #6515 are different.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @yuluo-yx

A new issue has been opened by @Aias00:

• Title: [BUG] Token-limiter resets the Redis TTL on every increment, so the time-window never resets under sustained traffic
• Link: [BUG] Token-limiter resets the Redis TTL on every increment, so the time-window never resets under sustained traffic #6649

Please review when you have time. Thank you! 🙏