I have implemented the AspNetCoreRateLimit in a website of mine. However, I am finding that AspNetCoreRateLimit is always using the longest rule first when determining if a request should be rate limited. For example, all of the second, minute, and hour rules seem to be ignored. The app always responds with x-rate-limit-limit: 7d when I have rules for smaller increments I would expect to show up first.
appsettings.json
"IpRateLimiting": {
"EnableEndpointRateLimiting": false,
"StackBlockedRequests": true,
"RealIpHeader": "X-Real-IP",
"ClientIdHeader": "X-ClientId",
"HttpStatusCode": 429,
"IpWhitelist": [],
"EndpointWhitelist": [],
"ClientWhitelist": [],
"GeneralRules": [
{
"Endpoint": "*",
"Period": "1s",
"Limit": 5
},
{
"Endpoint": "*",
"Period": "15m",
"Limit": 100
},
{
"Endpoint": "*",
"Period": "12h",
"Limit": 1000
},
{
"Endpoint": "*",
"Period": "1d",
"Limit": 1100
},
{
"Endpoint": "*",
"Period": "7d",
"Limit": 10000
}
]
},
startup.cs
services.AddSingleton<DAL>();
// needed to load configuration from appsettings.json
services.AddOptions();
// needed to store rate limit counters and ip rules
services.AddMemoryCache();
//load general configuration from appsettings.json
services.Configure<IpRateLimitOptions>(Configuration.GetSection("IpRateLimiting"));
//load ip rules from appsettings.json
services.Configure<IpRateLimitPolicies>(Configuration.GetSection("IpRateLimitPolicies"));
// inject counter and rules stores
services.AddInMemoryRateLimiting();
// configure the resolvers
services.AddSingleton<IRateLimitConfiguration, RateLimitConfiguration>();
app.UseIpRateLimiting();