I only see one issue; why are you rolling your own rate limiting? All the major languages and frameworks have libraries that do this, and every cloud provider I’ve used has some kind of mechanism for this as well.
A junior dev built a rate limiter
to block users making too many API requests:
if (requestCount > 100) {
return 200, { "error": "rate limit exceeded" }
}
It's deployed. It works.
What are the two flaws in this implementation
and how would you fix both?