When will ASP.NET Core Implementation of Rate Limiter start?

[JAYARAMGITHUB]

I recently read about the potential redesign of Ocelot’s Rate Limiting feature to utilize the .NET inbuilt RateLimiter class and the System.Threading.RateLimiting NuGet package, as discussed in the Future and ASP.NET Core Implementation article.

With .NET 8 now available and .NET 9 on the horizon, I’m eager to know when we might expect the new rate limiting feature using the .NET inbuilt Rate Limiter to be available in Ocelot. Any details on the roadmap or upcoming releases that will include this feature would be greatly appreciated.

Thank you for your continuous efforts in enhancing Ocelot. Looking forward to your response.

[raman-m]

Hello Jayaram,
We lack the necessary development capacity for this feature upgrade.
As a team, we invite you to contribute! Rest assured, we will offer guidance and conduct a detailed code review.

Concerning the roadmap... The next roadmap will be published with next major release of version 24.x. Also, I will consult with the team, and I am committed to assisting in the development of a roadmap for this substantial upgrade, contingent upon your confirmed intention to contribute.
Could you share your experience with using ASP.NET's native feature in other applications? What are your expertise and skills regarding the native feature?

[gonghuilie]

I also hope that this function can be improved. When my gateway is deployed in clusters, Rate limit counter is not supported. I tried many methods, but failed.

[raman-m]

I also hope that this function can be improved.

Certainly, we aim to prioritize the development of this feature once our current backlog is cleared. We also welcome professional contributions at any time.

When my gateway is deployed in clusters, Rate limit counter is not supported. I tried many methods, but failed.

The answer in discussion #2098 might be of assistance to you! Regrettably, the DistributedCacheRateLimitStorage feature remains unpublished in the documentation. We plan to publish the feature shortly.

[yjorayev]

Hi,

I am planning to see if I can make changes to use .Net Rate Limiting middleware. I would like to also be able to configure to run rate limiter AFTER the authentication, so that auth context can be used for limiting(for ex: claims from token).

Let me know your thoughts and I can start working on this soon.

[raman-m]

1. Is it okay for me to go ahead try integrate .Net Rate Limiting?

Certainly, integrating .NET Rate Limiting is a go!

However, please consider these challenges in our significant redesign:

• We need to maintain the existing rate limiting, also known as Ocelot's Own Implementation. This feature of Ocelot is set to evolve in 2025, with plans to introduce rate limiting based on the client's IP address (currently, it's only by header, which has its limitations and security concerns).
• The integration of the ASP.NET Implementation should reuse current interfaces and, if necessary, expand the functionality with additional interfaces for DI.
• We must create JSON options that allow for an effortless switch between the two implementations.
• Ideally, we aim for zero breaking changes, though minor upgrade instructions would be acceptable.

Are you up for this development challenge?
How many years have you been coding in C# for your .NET projects? I've reviewed your profile and noticed TypeScript and Python projects, which suggests that C# might not be your primary skill, correct?

[raman-m]

2. Do you have any thoughts/objections on allowing RateLimiter to run after Authentication?

Apologies, I will respond to this question later, either tonight or tomorrow...

[yjorayev]

Thank you, I will keep challenges you mentioned in mind.

Are you up for this development challenge? How many years have you been coding in C# for your .NET projects? I've reviewed your profile and noticed TypeScript and Python projects, which suggests that C# might not be your primary skill, correct?

I do .Net development for work since 2017, so I'd say C# is my primary programming language. Most of work in my personal profile is from college years.

[raman-m]

• Official PR: #2138 Introduce ASP.NET rate limiting #2188

[raman-m]

2. Do you have any thoughts/objections on allowing RateLimiter to run after Authentication?

Sure, I have concerns: current RateLimitingMiddleware must work for anonymous traffic. So, the current disposition is →

Ocelot/src/Ocelot/Middleware/OcelotPipelineExtensions.cs

Lines 79 to 92 in d310508

	// We check whether the request is ratelimit, and if there is no continue processing
	app.UseRateLimiting();
	// This adds or updates the request id (initally we try and set this based on global config in the error handling middleware)
	// If anything was set at global level and we have a different setting at re route level the global stuff will be overwritten
	// This means you can get a scenario where you have a different request id from the first piece of middleware to the request id middleware.
	app.UseRequestIdMiddleware();
	// Allow pre authentication logic. The idea being people might want to run something custom before what is built in.
	app.UseIfNotNull(pipelineConfiguration.PreAuthenticationMiddleware);
	// Now we know where the client is going to go we can authenticate them.
	// We allow the Ocelot middleware to be overriden by whatever the user wants.
	app.UseIfNotNull<AuthenticationMiddleware>(pipelineConfiguration.AuthenticationMiddleware);

So, I'm just curious, why did you ask the question?

I would like to also be able to configure to run rate limiter AFTER the authentication, so that auth context can be used for limiting(for ex: claims from token).

I guess this must be a new feature and new middleware. After the Ocelot app starts, its pipeline is static and can’t be changed. However, we can manage this by adding new middleware after the authorization one. You should keep in mind that routes can be anonymous or authenticated, so we need two middlewares to manage this.

What similar analogs do you know in the .NET world? Does Microsoft ASP.NET rate limiter process authenticated traffic? How? Could you share some links, please?

[raman-m]

The development has been started in

• PR #2138 Introduce ASP.NET rate limiting #2188