Skip to content

Designing Fair Token Bucket Policies for Real-Time Apps

Rate limiting real-time apps is complex. This guide details how to correctly size Token Bucket capacity (bursts) and refill rate (sustained throughput) for chat, gaming, and streaming. Learn to use per-user, per-type, and cost-based policies to ensure fairness and prevent abuse.

Read more →

Two Timestamps, One Message: Why WebSocket Systems Need Both

Never trust client-provided timestamps (meta.timestamp) for server logic like rate limiting or message ordering — it's a security vulnerability. Servers must capture their own authoritative ingress time (ctx.receivedAt) at arrival for security, data integrity, and audits. Client time is only for UI display.

Read more →