Limit: 10 a minute. 20 got through in 10 seconds.

transcript

Your limit is 10 requests a minute. A user just sent 20 in 10 seconds. Your limiter said yes to every one.

The fixed window. Count each minute, reset at the next. At 55 seconds, 10 requests. All allowed. The minute turns. The counter resets to zero. At 1 minute 5, 10 more. A fresh window. All allowed. 20 requests in 10 seconds. Each window only saw 10. So both said yes.

The fix: a window that slides. You could store every request's timestamp. Exact. But at scale that's a lot of memory, and a scan on every check. Or keep just two counters. This minute, and the last. Weight the last one by how much of it still overlaps. An estimate, but constant time.

It's 15 seconds past the minute. The last minute had 8 requests. 45 of its seconds still count. 75 percent. This minute has 3 so far. 6 plus 3 is 9. Under 10. Allowed. And the boundary burst is smoothed out.

A fixed window lets a burst double at every boundary. Two counters and one multiplication fix it.

Full breakdown in the lecture.