ratelimit-lab

Same traffic, five limiters

Every row replays one client's requests through a different algorithm set to the same quota. Worst window is the most requests any backend saw inside one real window, measured exactly. Anything above the limit leaked through.

allowed denied window boundary

Hit the API

Sends 12 requests to /api/ping (GCRA, 10 per 10s) and prints the RateLimit headers the middleware returns. With no server behind the page, the same middleware runs in this tab instead.

Waiting.