A rate limiter passed a live burst test on Oct 18 (requests refused after the limit). Two days later the same test returned success for every request. Nothing in the site looked different and no one had edited the code.
A Platform Template Sync Silently Switched Off a Safety Feature That Was Already Tested
Field Note #331
⚡ Quick Fix (TL;DR)
The Culprit: The hosting platform's automatic "sync upstream template files" update rewrote the server entry file and removed the lines that attached the limiter to its routes. The limiter code still existed, so a code search made it look present; it just was not connected to anything.
The Fix: Re-attach the limiter, put the connecting lines where the sync does not rewrite them, and add a test that fails if they disappear. More important, treat "it worked once" as expired: after every publish and after any automatic sync commit, repeat the live burst test (send one more request than the limit allows and confirm the refusal). Check what the live site does, not what the code appears to say.
Was this helpful? Thanks for the feedback!
Tagged in :