Short URL access limits (validSince/validUntil and maxVisits) are not enforced — redirects keep working

[zuoanCo]

Current behavior

I edited an existing short URL and set access limits on it (via shlink-web-client, "Limit access to the short URL" section):

• "Enabled since" (validSince): 2026-08-14 15:36
• "Enabled until" (validUntil): 2026-08-14 15:40
• "Maximum visits allowed" (maxVisits): 2

The limits are persisted correctly — when I reopen the short URL for editing, all three values are still there. However, they are never enforced:

• Today is 2026-08-19, five days after validUntil, and the short URL still redirects to the long URL.
• The short URL has been visited more than 2 times, well past maxVisits, and it still redirects.

The redirect itself works fine; only the access restrictions are ignored.

Expected behavior

Once validUntil is in the past, or the visit count reaches maxVisits, the short URL should stop redirecting and return the configured "invalid short URL" response (404 / error page).

Minimum steps to reproduce

1. Create a short URL, or edit an existing one, and set validSince/validUntil (a few minutes in the future) and maxVisits: 2.
2. Wait until validUntil has passed.
3. Visit the short URL → it still redirects to the long URL (expected: error page).
4. On a short URL with no date limits but maxVisits: 2, visit it 3+ times → it still redirects every time (expected: error page after the 2nd visit).

---

• Shlink version: 4.5.0
• PHP version: 8.4 (bundled in the official Docker image)
• How do you serve Shlink: Docker image
• Database engine: SQLite (default bundled with the Docker image)
• Database version: n/a

[acelaya]

I can't reproduce this, it works as expected for me. I have tried with Shlink 4.5, but also with Shlink 5.1 (latest version as of today).

Can you provide a docker compose config where this can be reproduced consistently? It might be related with some weird configuration combination. For example, depending on the values of REDIRECT_STATUS_CODE and/or REDIRECT_CACHE_LIFETIME, the browser might be caching the redirection, and it seems like the redirect still works, but simply because they are not hitting Shlink.

[zuoanCo]

Hi @acelaya, sorry for the noise — this turned out to be my own careless mistake.

I was forwarding traffic for the real domain on the same server that runs Shlink, so the requests were not actually hitting Shlink the way I expected. That made it look like the access limits (validSince/validUntil and maxVisits) were being ignored, when in fact the redirects were being served outside of Shlink.

After fixing the forwarding setup, the access limits are enforced exactly as expected: the short URL stops redirecting once validUntil has passed or maxVisits is reached.

Thanks a lot for your time looking into this, and apologies for the false report. Feel free to close this discussion.