Aias00 opened a new issue, #6649: URL: https://github.com/apache/shenyu/issues/6649
- severity: High - files: `shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-token-limiter/src/main/java/org/apache/shenyu/plugin/ai/token/limiter/AiTokenLimiterPlugin.java:177-183` - description: `recordTokensUsage` does `opsForValue().increment(cacheKey, tokens).flatMap(currentValue -> reactiveRedisTemplate.expire(cacheKey, Duration.ofSeconds(windowSeconds))).subscribe()`. Because `expire` is re-issued after every increment, as long as requests keep arriving within `windowSeconds` the key never expires and the counter is never reset. The intended "token budget N per window" becomes a monotonic lifetime cap. - impact: Time-window token quotas do not reset on schedule; sustained traffic gets permanently throttled until a quiet period. - suggested_fix: Set the TTL only on key creation (e.g. `INCR` then `EXPIRE NX`, or a small lua that sets expiry only when `EXISTS` is false). - confidence: High - related_existing: none — #6513/#6514/#6515 are different. --- _Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
