Skip to content

[#13] Redis INCR/EXPIRE race can permanently block an IP #1759

Description

@utksh1

rate_limiter.py: INCR then EXPIRE are not atomic; if EXPIRE is lost (Redis reconnect) the counter key persists forever with no TTL, permanently blocking the IP (DoS).

Fix: use INCR with EXPIRE only when TTL is -1, or a single SET ... NX EX command.

Metadata

Metadata

Labels

area:backendBackend API, database, or service workpriority:mediumImportant issue with normal urgencytype:bugBug fix work category bonus label

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions