fastapi-stream-lease · local demo

One user. One stream. Two tabs.

Each SSE stream holds a Redis lease. Both panels share one HttpOnly session cookie, so Tab B is rejected with 429 until Tab A finishes or disconnects.

Active streams

0 / 20

Per session

Per network

Backend

checking...

Try this

Open Tab A and let it stream.
Open Tab B while A is running. It gets 429 from the per-session lease.
Disconnect A or let it finish.
Open B again. The slot is free.

Request path

rate limitper-IP guardper-session leaseSSE

The per-IP guard is set to 2 so two tabs can reach the session lease. A third session from the same network is rejected by the IP guard.

Tab A

First stream, holds the lease

idle

Tokens received 0 / 0 Last token —

Ready.

Tab B

Same cookie, same session

idle

Tokens received 0 / 0 Last token —

Ready.

What you are seeing

Each stream is a synthetic 20-second SSE response. No LLM calls or API keys are involved.
The lease lives in Redis with a 25-second TTL and is renewed while the response is open.
Limits: 1 per session, 2 per network, 20 globally.
Request rate limit: 30 stream attempts per minute per IP.
Tab B is rejected by the per-session lease. A third session from the same network would hit the per-IP guard.
If Redis is unavailable, the API returns 503 instead of silently allowing streams.