🐛 fix(limiter): floor sub-second expiration in sliding window

middleware/limiter/limiter_sliding.go

@@ -45,6 +45,12 @@ func (SlidingWindow) New(cfg *Config) fiber.Handler {
 			expirationDuration = ConfigDefault.Expiration
 		}
 		expiration := uint64(expirationDuration.Seconds())
+		// Sub-second expirations truncate to 0 seconds, which would make the
+		// window weight a division by zero (NaN rate -> every request is
+		// rejected). Floor the window to 1 second.
+		if expiration == 0 {
+			expiration = 1
+		}
 
 		// Get key from request
 		key := cfg.KeyGenerator(c)

middleware/limiter/limiter_test.go

@@ -1863,3 +1863,25 @@
 	cfg.clock = func() time.Time { return time.Unix(42, 0) }
 	require.Equal(t, uint64(42), cfg.currentSecond())
 }
+
+// TestLimiterSlidingSubSecondExpiration is a regression test: a sub-second
+// ExpirationFunc truncated to 0 seconds via uint64(d.Seconds()), so the
+// sliding window weight became a division by zero (NaN rate) and every
+// request was rejected. The window must floor to 1 second: requests within
+// Max are admitted.
+func TestLimiterSlidingSubSecondExpiration(t *testing.T) {
+	t.Parallel()
+
+	app := fiber.New()
+	app.Use(New(Config{
+		Max:               5,
+		LimiterMiddleware: SlidingWindow{},
+		ExpirationFunc:    func(fiber.Ctx) time.Duration { return 500 * time.Millisecond },
+	}))
+	app.Get("/", func(c fiber.Ctx) error { return c.SendString("Hello tester!") })
+
+	// Without the fix the very first request is wrongly rejected with 429.
+	resp, err := app.Test(httptest.NewRequest(fiber.MethodGet, "/", nil))
+	require.NoError(t, err)
+	require.Equal(t, fiber.StatusOK, resp.StatusCode)
+}