dotnet / dotnet/aspnetcore

Support Multiple PartitionedRateLimiter Per Endpoint

Open
#42,691 40 comments 33 reactions 0 assignees View on GitHub
area-middleware feature-rate-limit
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

Right now RateLimiting middleware has two `PartitionedRateLimiter`. A **global** and an **endpoint** limiter. This means for each endpoint there could be at most two level of rate limiters and also the global one is somehow limited because it must be same for all endpoints.
So I can not limit my endpoints based on more than two partitions. As an example I need to limit first based on request IP, then current user Id and then based on the current endpoint.
Let's say I need to limit 10 requests per second per IP, no matter which endpoint. And also limit 5 requests per second per User Id.

Also I can't have different window and limit based on one partition. Again let's say I need to limit 10 requests per second per IP and also limit 40 requests per minute per IP.

### Describe the solution you'd like

I'm suggesting to create `PartitionedRateLimiter` based on policy and have a `Dictionary` which policy is the key. The endpoints could have multiple `IRequireRateLimitMetadata` and every one of them is a policy with its own `PartitionedRateLimiter`. And the middleware would always call Acquire on each of these limiters whether `IsAcquired` is true or false and only limit the request if one of them has IsAcquired = false.

This way part of the limiter like checking based on User Id could be shared between multiple endpoints too.

### Additional context

cc @wtgodbe @BrennanConroy @halter

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.