pub const DEFAULT_STORE_TIMEOUT: Duration;Expand description
Default ceiling on one store.consume call — first attempt and any
backend-internal retry, as a single budget.
The security review measured the alternative: redis’s
ConnectionManager defaults both its connection and response timeouts
to None, so during a real outage each attempt awaited an unbounded
reconnect cycle — 9.46s, doubled to 18.92s by the retry. “Degrade to
unlimited” silently meant “hang for nineteen seconds, then allow”,
which is worse for the caller than the refusal it replaced and is
itself a denial-of-service lever.
500ms is chosen to be far above a healthy Redis round-trip (sub-
millisecond on a local network, single-digit milliseconds across an
availability zone) and far below anything a human would call a hang.
Tune with super::RateLimitLayer::with_store_timeout.