Rate limiting real-time apps is complex. This guide details how to correctly size Token Bucket capacity (bursts) and refill rate (sustained throughput) for chat, gaming, and streaming. Learn to use per-user, per-type, and cost-based policies to ensure fairness and prevent abuse.
Never trust client-provided timestamps (meta.timestamp) for server logic like rate limiting or message ordering — it's a security vulnerability. Servers must capture their own authoritative ingress time (ctx.receivedAt) at arrival for security, data integrity, and audits. Client time is only for UI display.
✨ Building real-time apps? Learn to tame WebSocket chaos with Bun and WS-Kit! This post introduces WS-Kit, a type-safe WebSocket router that brings clean routing and type safety to your Bun WebSocket messages, replacing messy switch statements with structured, validated handlers.