Github 304 responses seem to count against rate limit - github-api

Question

I'm running into an issue with the github api counting requests that yeild a 304 response against the rate limit
GET /repos/******/***/contents/***?ref=master HTTP/1.1
Host: api.github.com
Connection: keep-alive
Cache-Control: max-age=0
Sec-Fetch-Dest: empty
If-None-Match: W/"b15846765021dc2483e5f3110b53a69f210ececa"
If-Modified-Since: Thu, 19 Mar 2020 01:33:51 GMT
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Accept: */*
Origin: *******
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Referer: ******
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
this request will return with a 304 and no body, but X-Ratelimit-Remaining decrements.
Conditional Github Requests
Note: Making a conditional request and receiving a 304 response does not count against your Rate Limit, so we encourage you to use it whenever possible.
I'm only setting the If-None-Match and If-Modified-Since headers, the rest are set by the browser (using fetch api)
Request
This can be replicated with just a browser by navigating to https://api.github.com/repos/angular/angular/contents/?ref=master and making sure disable cache is off in the developer console
Responses
On first call
If-None-Match and If-Modified-Since are not set
HTTP/1.1 200 OK
date: Wed, 01 Apr 2020 12:43:09 GMT
content-type: application/json; charset=utf-8
server: GitHub.com
status: 200 OK
cache-control: public, max-age=60, s-maxage=60
vary: Accept, Accept-Encoding, Accept, X-Requested-With
etag: W/"b15846765021dc2483e5f3110b53a69f210ececa"
last-modified: Thu, 19 Mar 2020 01:33:51 GMT
x-github-media-type: github.v3; format=json
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
content-encoding: gzip
X-Ratelimit-Limit: 60
X-Ratelimit-Remaining: 59
X-Ratelimit-Reset: 1585748589
Accept-Ranges: bytes
Content-Length: 1696
X-GitHub-Request-Id: B298:74D9:10D7B8:177665:5E848C5D
followed by the requested data
Subsequent Calls:
If-None-Match and If-Modified-Since are set to etag and last-modified header from previous request
HTTP/1.1 304 Not Modified
date: Wed, 01 Apr 2020 12:44:51 GMT
content-type: application/json; charset=utf-8
server: GitHub.com
status: 200 OK
cache-control: public, max-age=60, s-maxage=60
vary: Accept, Accept-Encoding, Accept, X-Requested-With
etag: W/"b15846765021dc2483e5f3110b53a69f210ececa"
last-modified: Thu, 19 Mar 2020 01:33:51 GMT
x-github-media-type: github.v3; format=json
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'
content-encoding: gzip
X-Ratelimit-Limit: 60
X-Ratelimit-Remaining: 58
X-Ratelimit-Reset: 1585748589
X-GitHub-Request-Id: FC10:2036:26E528:346432:5E848CC3
no data is returned.
According to the documentation X-Ratelimit-Remaining should have stayed at 59
Is there something wrong with my request or is there a bug with the ratelimit on githubs end?

Answer 1

got the same problem. and resolved it. i've added to headers 'Authorization' key with string value. i'm using python and requests for humans. so in my console looks this like that:
>>> response = requests.get('http://api.github.com/repos/zappycode/zappycode-django/commits', headers={'Authorization': 'JustaString', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0', 'If-Modified-Since': 'Sat, 18 Jul 2020 00:15:14 GMT'})
>>> response.headers
{'Date': 'Tue, 21 Jul 2020 09:06:05 GMT', 'Server': 'GitHub.com', 'Status': '304 Not Modified', 'X-RateLimit-Limit': '60', 'X-RateLimit-Remaining': '59', 'X-RateLimit-Reset': '1595323695', 'Cache-Control': 'public, max-age=60, s-maxage=60', 'Vary': 'Accept, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding', 'ETag': '"03e2ffed23748e4e7fee925076e63b47"', 'Last-Modified': 'Sat, 18 Jul 2020 00:15:14 GMT', 'Access-Control-Expose-Headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset', 'Access-Control-Allow-Origin': '*', 'Strict-Transport-Security': 'max-age=31536000; includeSubdomains; preload', 'X-Frame-Options': 'deny', 'X-Content-Type-Options': 'nosniff', 'X-XSS-Protection': '1; mode=block', 'Referrer-Policy': 'origin-when-cross-origin, strict-origin-when-cross-origin', 'Content-Security-Policy': "default-src 'none'", 'X-GitHub-Request-Id': 'B6AC:EC41:82A5D:B3030:5F16AFFD'}
>>> response_2 = requests.get('http://api.github.com/repos/zappycode/zappycode-django/commits', headers={'Authorization': 'JustaString', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0', 'If-Modified-Since': 'Sat, 18 Jul 2020 00:15:14 GMT'})
>>> response_2.headers
{'Date': 'Tue, 21 Jul 2020 09:06:44 GMT', 'Server': 'GitHub.com', 'Status': '304 Not Modified', 'X-RateLimit-Limit': '60', 'X-RateLimit-Remaining': '59', 'X-RateLimit-Reset': '1595323695', 'Cache-Control': 'public, max-age=60, s-maxage=60', 'Vary': 'Accept, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding', 'ETag': '"03e2ffed23748e4e7fee925076e63b47"', 'Last-Modified': 'Sat, 18 Jul 2020 00:15:14 GMT', 'Access-Control-Expose-Headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset', 'Access-Control-Allow-Origin': '*', 'Strict-Transport-Security': 'max-age=31536000; includeSubdomains; preload', 'X-Frame-Options': 'deny', 'X-Content-Type-Options': 'nosniff', 'X-XSS-Protection': '1; mode=block', 'Referrer-Policy': 'origin-when-cross-origin, strict-origin-when-cross-origin', 'Content-Security-Policy': "default-src 'none'", 'X-GitHub-Request-Id': 'A962:EC4D:11CCB9AF:15D06EA5:5F16B023'}
>>> response_3 = requests.get('http://api.github.com/repos/zappycode/zappycode-django/commits', headers={'Authorization': 'JustaString', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0', 'If-Modified-Since': 'Sat, 18 Jul 2020 00:15:14 GMT'})
>>> response_3.headers
{'Date': 'Tue, 21 Jul 2020 09:07:39 GMT', 'Server': 'GitHub.com', 'Status': '304 Not Modified', 'X-RateLimit-Limit': '60', 'X-RateLimit-Remaining': '59', 'X-RateLimit-Reset': '1595323695', 'Cache-Control': 'public, max-age=60, s-maxage=60', 'Vary': 'Accept, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding', 'ETag': '"03e2ffed23748e4e7fee925076e63b47"', 'Last-Modified': 'Sat, 18 Jul 2020 00:15:14 GMT', 'Access-Control-Expose-Headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset', 'Access-Control-Allow-Origin': '*', 'Strict-Transport-Security': 'max-age=31536000; includeSubdomains; preload', 'X-Frame-Options': 'deny', 'X-Content-Type-Options': 'nosniff', 'X-XSS-Protection': '1; mode=block', 'Referrer-Policy': 'origin-when-cross-origin, strict-origin-when-cross-origin', 'Content-Security-Policy': "default-src 'none'", 'X-GitHub-Request-Id': 'A968:69B0:11A84908:159BBA46:5F16B05B'}
hope it's gonna work for u :)

Answer 2

According to the documentation X-Ratelimit-Remaining should have stayed at 59
This 59 here suggests that you're performing unauthenticated requests, which might be key here. I wonder if this is related to the rate limits for unauthenticated requests not being measured in the same way as authenticated requests, and this situation may not be considered a "conditional" request.
This case is not documented explicitly, but GitHub highly recommends using authenticated requests as these rate limits are tracked per-account, not per-IP address.