Why Fixed-Window Rate Limiters Have a Security Flaw and How to Fix It

Fixed-window rate limiters, commonly used in Express APIs to guard against DDoS and brute-force attacks, contain a critical boundary vulnerability that attackers can exploit. By firing the maximum allowed requests just before and just after a window resets, an attacker can double the permitted traffic within seconds without technically breaking any rules. A sliding window algorithm addresses this by continuously tracking request history rather than resetting on a rigid clock cycle. An optimized version uses just two integer counters per IP address — current and previous window counts — to estimate traffic with O(1) time and space complexity. This approach is especially important for sensitive systems like FinTech payment gateways and authentication endpoints where burst traffic can enable credential-stuffing attacks.