TryBugHunt

The Thundering Midnight Burst

hardpython

Distributed rate limiting fails under clock-boundary alignment and idle token accumulation

0:00
Step 1: Test Traffic & Expose Flaw
"""
Sliding Window Rate Limiter
Evaluates whether an incoming request within a sliding window interval is permitted.
"""

class SlidingWindowLimiter:
    def __init__(self, limit=10, window_seconds=1.0):
        self.limit = limit
        self.window_seconds = window_seconds
        self.client_windows = {}

    def is_allowed(self, client_id, timestamp):
        # AI Attempt: Fixed window calculation using integer floor
        # BUG: Requests at 0.9s and 1.1s fall into different windows,
        # allowing 2x limit to pass across the boundary!
        window_start = int(timestamp / self.window_seconds) * self.window_seconds
        
        if client_id not in self.client_windows:
            self.client_windows[client_id] = {}
            
        windows = self.client_windows[client_id]
        current_count = windows.get(window_start, 0)
        
        if current_count < self.limit:
            windows[window_start] = current_count + 1
            return True
        return False
Step 1: Test Traffic & Expose Flaw

Simulate boundary traffic alignment and idle bursts to expose how a client punches through the 10 req/sec quota.

Choose Traffic Scenario to TestClick to simulate
Architectural Guide & Interview Notes
↑ Jump to Interactive Studio

Deep Dive: The Thundering Midnight Burst

An engineering analysis of why this AI-generated Pull Request passed isolated unit tests, how multi-tenant traffic exposes the architectural flaw, and how interviewers score your response.

The Root Cause Anti-Pattern

The Interviewer's Scoring Rubric

Candidates are assessed on whether they jump to trial-and-error editing or follow a hypothesis-driven approach. A "Strong Hire" candidate restates the data flow between modules, explains why single-client unit tests passed, crafts an adversarial probe showing cross-tenant leakage, and implements a surgical 1-line patch without breaking existing contracts.

Candidate Strategy for the Code Comprehension Round

  1. 1Map Module ContractsTrace how the gateway invokes the underlying service. Note what data is passed by reference vs. by value.
  2. 2Break It With An Adversarial ProbeSimulate concurrent or sequential traffic across multiple identities to force shared state mutation.
  3. 3Deliver a Surgical PatchMake the minimal required diff to ensure proper per-client state isolation without refactoring unnecessary files.