API additions for RateLimitingMiddleware

[wtgodbe]

NOTE - This is the original draft of the proposal. The updated proposal is at this comment: #42667 (comment)

namespace Microsoft.AspNetCore.RateLimiting

+    public interface IRateLimiterMetadata
+    {
+    }

+    public interface IRequireRateLimiterMetadata : IRateLimiterMetadata
+    {
+        string PolicyName { get; }
+    }

+    public class RequireRateLimiterMetadata : IRequireRateLimiterMetadata 
+    {
+        public RequireRateLimiterMetadata (string policyName)
+        public string PolicyName { get; }
+    }

+    public interface IDisableRateLimiterMetadata : IRateLimiterMetadata
+    {
+    }

+    public class DisableRateLimiterMetadata : IDisableRateLimiterMetadata 
+    {
+        public RequireRateLimiterMetadata ()
+    }

    public interface IRateLimiterPolicy<TPartitionKey>
    {
-        Func<OnRejectedContext, CancellationToken, ValueTask>? OnRejected { get; }
+        ValueTask OnRejected(OnRejectedContext onRejectedContext, CancellationToken cancellationToken)
    }

namespace Microsoft.AspNetCore.Builder

   public static class RateLimiterApplicationBuilderExtensions
    {
        public static IApplicationBuilder UseRateLimiter(this IApplicationBuilder app)
-       public static IApplicationBuilder UseRateLimiter(this IApplicationBuilder app, RateLimiterOptions options)
    }

+   public static class RateLimiterServiceCollectionExtensions
+    {
+        public static IServiceCollection AddRateLimiter(this IServiceCollection services, Action<RateLimiterOptions > configureOptions)
+    }

    public static class RateLimiterOptionsExtensions
    {
-        public static RateLimiterOptions AddNoLimiter(this RateLimiterOptions options, string policyName)
    }

    public static class RateLimiterEndpointConventionBuilderExtensions
    {
+        public static TBuilder DisableRateLimiting<TBuilder>(this TBuilder builder) where TBuilder : IEndpointConventionBuilder
    }

Q's - keep OnRejected as a Func because it's nullable? Change extension methods like AddTokenBucketLimiter to AddTokenBucketLimiterPolicy? Add an attribute for MVC Controllers?

[BrennanConroy]

I like the idea of skipping the middleware suggested in #41667 (comment)

Thank you for submitting this for API review. This will be reviewed by @dotnet/aspnet-api-review at the next meeting of the ASP.NET Core API Review group. Please ensure you take a look at the API review process documentation and ensure that:

• The PR contains changes to the reference-assembly that describe the API change. Or, you have included a snippet of reference-assembly-style code that illustrates the API change.
• The PR describes the impact to users, both positive (useful new APIs) and negative (breaking changes).
• Someone is assigned to "champion" this change in the meeting, and they understand the impact and design of the change.

[halter73]

Meeting notes:

• Let's get rid of the IRateLimiterMetadata inheritance hiearcy.

  • Rename IRequireRateLimiterMetadata to IRateLimiterMetadata. And RequireRateLimiterMetadata to RateLimiterMetadata.
  • IDisableRateLimiterMetadata stays the same name.

• Should we allow policies defined inline?

  • It seems straightforward enough to implement well with the little time we have and it would be convenient.

• UseRateLimiter(this IApplicationBuilder app, RateLimiterOptions options) should stay. We should still add AddRateLimiter. This is the same pattern as AddWebSockets.

• Let's keep Func<OnRejectedContext, CancellationToken, ValueTask>? OnRejected { get; } so we know whether or not to call the global OnRejected callback. If we make it a normal method instead, we'd have to be okay with okay with always running the global OnRejected first.

• Let's add attributes!

  • How about [RateLimit("MyPolicy")]?
  • Anything else?
    • Not at the moment. In the future (post .NET 7), it might be nice to specify rate limiting options directly via endpoint metadata though.

• Let's put everything in the ASP.NET Core shared framework. We'll have to include System.Threading.RateLimiting in the ASP.NET Core shared framework similar to System.IO.Pipelines.

• One last curveball from @DamianEdwards: Why can't I configure the rate limiter options (e.g. TokenBucketRateLimiterOptions) with a callback like every other "option" type?

  • The properties are read-only. You need to use the constructor.
  • Let's fix that and add setters and a default ctor to all the options types. It will have to go through runtime API review.
  • We'll also have to update methods like AddTokenBucketLimiter to take an Action<TokenBucketRateLimiterOptions> instead of TokenBucketRateLimiterOptions directly.

[davidfowl]

This looks great so far 😄

[Kahbazi]

IDisableRateLimiterMetadata stays the same name.

How about this one:

+    public interface IDisableRateLimiterMetadata
+    {
+        bool IsDisabled { get; }
+    }

This is according to the Guidelines and can be overriden if necessary.

How about [RateLimit("MyPolicy")]?

Also [DisableRateLimit]?

We'll also have to update methods like AddTokenBucketLimiter to take an Action instead of TokenBucketRateLimiterOptions directly.

Can it be Action<TokenBucketRateLimiterOptions, HttpContext>? This way the options could be based on the custom metadata on an endpoint.

[davidfowl]

Agree with @Kahbazi on the disable attribute. We need attributes for anything we have methods for.

[DamianEdwards]

Why does the IDisableRateLimiterMetadata need a property at all? Shouldn't it simply be a marker, like IAllowAnonymous?