createSession RateLimit seems not to work as specified in yesterday's blog post

[MedeHurGang]

https://atproto.com/blog/rate-limits-pds-v3 states the RateLimit for createSession is 30/5min and 300/day.

But it seems either the header 'ratelimit-reset' is wrong (the timestamp is 24 hours in the future) or the RateLimit is not set according the specs in the blog post.
Which would lead to 30 createSession/day not 300 as described.

[derun-info]

I have not seen the headers, but I definitely do not make 300 calls a day. Yet, I am seeing rate exceeded errors on login() starting today.

[legalbit]

The 5-minute window does not work here. The headers for a createSession look like this:

Successful request; remaining requests 0:

{
    "Date": "Mon, 18 Sep 2023 10:31:30 GMT",
    "Content-Type": "application/json; charset=utf-8",
    "Content-Length": "659",
    "Connection": "keep-alive",
    "X-Powered-By": "Express",
    "Access-Control-Allow-Origin": "*",
    "RateLimit-Limit": "30",
    "RateLimit-Remaining": "0",
    "RateLimit-Reset": "1695112965",
    "RateLimit-Policy": "30;w=300",
    "ETag": "W/\"293-zhYCCHcEPfrg3X1rKxTzazidQ1M\"",
    "Vary": "Accept-Encoding"
}

RateLimit exceeded after 8 minutes; should be reset according to the 30;w=300 policy:

{
    "Date": "Mon, 18 Sep 2023 10:40:45 GMT",
    "Content-Type": "application/json; charset=utf-8",
    "Content-Length": "61",
    "Connection": "keep-alive",
    "X-Powered-By": "Express",
    "Access-Control-Allow-Origin": "*",
    "RateLimit-Limit": "30",
    "RateLimit-Remaining": "0",
    "RateLimit-Reset": "1695112965",
    "RateLimit-Policy": "30;w=300",
    "ETag": "W/\"3d-egyFOcXCrKQFzoI7522/4+PpxIk\"",
    "Vary": "Accept-Encoding"
}

[dholms]

Thanks for the bug report - we were handling this wrong. I'll get this shipped up shortly 👍

#1627

[EvilJordan]

Sorry to reply to this ancient and closed post, @dholms, but I'm seeing the 24hr rate limit for a CredentialSession.login call right now, and there's 1) no way I tried to log in 100 times today and 2) is the 24hr limit (100;w=86400) correct?

headers: {
    'access-control-allow-origin': '*',
    connection: 'keep-alive',
    'content-length': '61',
    'content-type': 'application/json; charset=utf-8',
    date: 'Sun, 17 Nov 2024 04:35:48 GMT',
    etag: 'W/"3d-egyFOcXCrKQFzoI7522/4+PpxIk"',
    'ratelimit-limit': '100',
    'ratelimit-policy': '100;w=86400',
    'ratelimit-remaining': '0',
    'ratelimit-reset': '1731885139',
    vary: 'Accept-Encoding',
    'x-powered-by': 'Express'
  }