express-rate-limit/express-slow-down

Rationale behind linear backoff

make-github-pseudonymous-again opened this issue · 3 comments

make-github-pseudonymous-again commented

Can one explain why linear backoff (additive) is appropriate here? Rather than exponential backoff (multiplicative) for instance.

nfriedly commented

Hey, sorry I missed this; notifications got turned off somehow.

As for linear vs exponential, linear seemed to work well enough, so I just left it at that.

Jakeroid commented

Would be great to have exponential backoff in the package? I am asking, coz maybe I could try to implement that.

nfriedly commented

Yeah, that sounds fine. If we made it a function, you'd probably want to pass in a few arguments - the number of hits, the request, the response, maybe the full configuration.

Actually, if we made it trigger after setting req.slowdown instead of before, we could use that for the current number of hits. So, the default might look like

function calculateDelay(req, res, config) {
  return (req.slowdown.current - config.delayAfter) * config.delayMs;
}

and then this line could be updated with a call to config.calculateDelay instead of doing the math there:

express-slow-down/lib/express-slow-down.js

Line 65 in c70c381

const unboundedDelay = (current - delayAfter) * delayMs;

And then we could offer a built-in exponential option that did Math.pow() instead of *, or folks could come up with their own.