letsencrypt / letsencrypt/boulder
Rate limits incorrect after overridden until next TAT
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
Since we switched to GCRA, we've had a bug in our rate limits when an override changes.
We don't update the TAT until the next successful issuance, so when increasing a rate-limit, we'll continue to deny until we reach that TAT, and we'll return an incorrect error message that says you've exceeded your new rate limit when you've actually exceeded the old rate limit.
This can be particularly confusing if you've had a rate limit increase, and our error messages tell you that you've already exceeded the new limit.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the Go implementation of GCRA rate-limit overrides, focusing on when the TAT is updated and how the exceeded-limit error message is selected. Reproduce an increased-limit override and verify that issuance is no longer denied based on the old TAT and that the message reflects the applicable limit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100