Requests throttling/ratelimit solution

[tyzhnenko]

I found that BackSheep doesn't have a throttling request feature. I guess the feature can be implemented like a middleware.

I'm not sure that such middleware should be placed in the framework but who knows? Maybe a separate package will be more useful.

[RobertoPrevato]

I see favorably adding that feature to the web framework, and yes a middleware would work well in this case.

• if it can be implemented without adding extra dependencies (at first sight, I think this is true in this case), it could be kept inside the web framework itself
• otherwise in a dedicated package, if extra dependencies are needed, or if you want to be owner of that repository. This would give you complete freedom of action and you could implement it as you wish: the extension could be documented in the blacksheep site anyway.

If it was inside the web framework, I would define an abstract class to describe the code API of the policy for rate limiting, used by the middleware, and then some built-in concrete implementations of that class.

[tyzhnenko]

Oh, I guess it can be implemented like the current authorization middleware in the framework. A new middleware that applies user-defined rules to request and allow/disallow. To give everyone a possibility to extend a build-in solution.

[RobertoPrevato]

I agree, it sounds good.

[tyzhnenko]

I'm working on a simple oauth2 password grants solution for BlackSheep. To make BlackSheep possible to issue tokens and not only verify. And then I'll try to make some PoC of the rate limiter and share it.