A debugging story about layered limits in a FastAPI SSE demo.

I built a small browser demo for fastapi-stream-lease to show how a Redis lease stops one user from holding several long-lived streams at the same time. Two tabs, one session cookie, a synthetic 20-second SSE stream. The first tab streams. The second tab gets 429 . Everything looked correct.

It wasn't.

The 429 was real, but it came from the wrong limiter. The second tab was rejected by a demo-specific per-IP guard before it reached the per-session Redis lease I wanted to show. The tests passed. The UI looked fine. The only thing wrong was the story the demo was telling.

This is how I found it, what I changed, and why I now test the layer that rejects a request, not just the status code.

What the demo does

The demo is local-only. It runs with:

docker compose up --build demo

Enter fullscreen mode

Exit fullscreen mode

It starts Redis and a small FastAPI app at http://localhost:8080 . The app has two panels.…