ThreeMammals/Ocelot

Claim-based rate limiting

Open

#1,587 创建于 2022年7月18日

在 GitHub 查看
 (8 评论) (0 反应) (0 负责人)C# (8,137 star) (1,617 fork)batch import
AuthenticationRate Limitingacceptedfeaturehelp wantedproposal

描述

New Feature

Extracting claims from the token and use as a Client ID in the rate limiting. Suggesting a new feature to implement the rate limiting based on the claims in the token.

Motivation for New Feature

Current rate limiting is based on the Client ID passed in the header from the request. There are chances that anyone can manipulate the request by updating headers and using APIs without any restriction.

So, instead of depending on the consumer to provide the Client ID in the header, we can use the claims from the token. Which is more secure and not modifiable. Considering this, a rate limit will be applicable for authenticated endpoints only.

Specifications

  • Version: 18.1.0
  • Platform: .NET 6

贡献者指南

技术栈
csharp
领域
securityauthenticationauthorizationperformanceapibackend
议题类型
feature
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
3-5 days
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
stale
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
Understanding of .NET middlewareFamiliarity with JWT claimsKnowledge of Ocelot's rate limitingC#
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
50
研究方向
Begin by reviewing the existing rate limiting middleware in Ocelot (likely in the Ocelot source code under Middleware or RateLimit). Look for where ClientId is currently extracted from headers. Then explore the authentication middleware to see how token claims are made available. The goal is to optionally use a claim like sub or client id from the token for rate limiting. Check the issue comments for any maintainer guidance or linked PRs. Consider adding a configuration option to choose between header based and claim based Client ID. Ensure the implementation only affects authenticated endpoints.