Class ClientRateLimitOptions

Provides options for a fixed window rate limit that applies to each client address separately.

Inheritance
object
ClientRateLimitOptions
Namespace: Singulink.Net.Http.Api.Service
Assembly: Singulink.Net.Http.Api.Service.dll
public sealed class ClientRateLimitOptions

The client address is RemoteIpAddress, so services behind a proxy must apply the forwarded client address before rate limiting runs. A request from a private or loopback address with an X-Forwarded-For, Forwarded, X-Real-IP or CF-Connecting-IP header is logged as a warning, once for each limit. IPv6 clients are limited per /64 network, since a single client usually controls a whole /64. GetClientKey(IPAddress?) returns the key that a client address is counted under.

Clients in ExemptNetworks are never limited, and neither are private addresses and connections without a remote IP address when ExemptPrivateNetworks is true.

Requests are counted in the registered IShortLivedStore, or in one MemoryShortLivedStore that all the limits of the app share if none is registered, so with a store that all of a service's servers share, a client's limit holds across all of them. Windows start at fixed times on the clock (a one-minute window starts at every full minute), so that all servers count the same window.

The options can be bound from configuration, for example a section with "ExemptNetworks": ["203.0.113.7", "2001:db8:1234::/48"].

Properties

Name Description

Gets or sets a value indicating whether requests are limited. When false, no request is limited. Default is true.

Gets the additional addresses and networks whose clients are exempt from the limit, such as an office's public IP address. Each entry is an IP address (for example 203.0.113.7) or a network in CIDR notation (for example 2001:db8:1234::/48).

Gets or sets a value indicating whether clients with private, loopback, link-local, shared (100.64.0.0/10) or unique local IPv6 addresses, and connections without a remote IP address (such as Unix domain sockets), are exempt from the limit. IPv4-mapped IPv6 addresses are treated as the IPv4 address they map. Default is false.

Gets or sets the maximum number of requests a client can make in each window. Must be set to a positive value before the limit is added.

Gets or sets the maximum number of requests from a client that wait for the next window once the limit is reached, instead of being rejected. The queue is kept on each server, and waiting requests try again in no particular order when each window starts. Default is 0 (requests over the limit are rejected immediately).

Gets or sets the message of the error that requests rejected by this limit receive, or null for the message of the rejection response (see SetApiRejectionResponse(RateLimiterOptions, string?)). Default is null.

Gets or sets the length of the window that PermitLimit applies to. Default is 1 minute.

Methods

Name Description
GetClientKey(IPAddress?)

Gets the key that the per-client limits count requests from the specified client address under. Requests from addresses with the same key share a count.