Class RateLimiterOptionsExtensions

Namespace

NuvTools.Security.AspNetCore.RateLimiting

Assembly

NuvTools.Security.AspNetCore.dll

Extension methods for limiting anonymous endpoints, such as sign-in, sign-up and password recovery, by the address a request comes from.

public static class RateLimiterOptionsExtensions

Inheritance

object

RateLimiterOptionsExtensions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

AddFixedWindowPerClientAddress(RateLimiterOptions, string, int, TimeSpan)

Adds a policy that lets each client address make permitLimit requests per window, and rejects the rest at once.

public static RateLimiterOptions AddFixedWindowPerClientAddress(this RateLimiterOptions options, string policyName, int permitLimit, TimeSpan window)

Parameters

options RateLimiterOptions

The rate limiter options to add the policy to.

policyName string

The name an endpoint uses to apply the policy.

permitLimit int

Requests allowed per address in each window.

window TimeSpan

Length of the window.

Returns

RateLimiterOptions

The options for chaining.

Remarks

The partition key is the policy name followed by the address. Each policy therefore counts on its own: using up the allowance for asking for a reset link does not use up the allowance for spending one.

There is no queue. A caller past the limit gets the rejection straight away instead of having its connection held open.

The address is RemoteIpAddress. Behind a proxy, call UseForwardedHeaders before UseRateLimiter, or every caller shares the proxy's address. A request with no address falls into one shared bucket rather than going unlimited. An address is something a caller can vary, so this bounds noise and unsophisticated scripts; it does not replace account lockout or a uniform answer that hides whether an account exists.

SetTooManyRequests(OnRejectedContext)

Sets the response status to 429 and, when the limiter knows it, the Retry-After header in seconds.

public static void SetTooManyRequests(this OnRejectedContext context)

Parameters

context OnRejectedContext

The context passed to OnRejected.

Remarks

Writes no body, so an API can add its own error envelope and a page can render its own message.