apache / apache/shenyu

[BUG] Token-limiter resets the Redis TTL on every increment, so the time-window never resets under sustained traffic

Open
#6,649 1 comment 0 reactions 0 assignees View on GitHub
feature: plugin priority: high type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: High
- files: `shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-token-limiter/src/main/java/org/apache/shenyu/plugin/ai/token/limiter/AiTokenLimiterPlugin.java:177-183`
- description: `recordTokensUsage` does `opsForValue().increment(cacheKey, tokens).flatMap(currentValue -> reactiveRedisTemplate.expire(cacheKey, Duration.ofSeconds(windowSeconds))).subscribe()`. Because `expire` is re-issued after every increment, as long as requests keep arriving within `windowSeconds` the key never expires and the counter is never reset. The intended "token budget N per window" becomes a monotonic lifetime cap.
- impact: Time-window token quotas do not reset on schedule; sustained traffic gets permanently throttled until a quiet period.
- suggested_fix: Set the TTL only on key creation (e.g. `INCR` then `EXPIRE NX`, or a small lua that sets expiry only when `EXISTS` is false).
- confidence: High
- related_existing: none — #6513/#6514/#6515 are different.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Read shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-token-limiter/src/main/java/org/apache/shenyu/plugin/ai/token/limiter/AiTokenLimiterPlugin.java:177-183 and trace recordTokensUsage. Verify that the Redis TTL is not refreshed by each increment and that the token window resets under sustained traffic; done means the quota resets on schedule.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, redis
Domain
backend, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.