Microsoft.AspNetCore.RateLimiting RateLimiterPolicy GetPartitionAsync

Background and Motivation

I want to save API rate limits in the database and have the possibility of changing them at runtime (eg: based on the customer’s subscription/licensing/etc).

The problem is that IRateLimiterPolicy doesn’t have an async method

public class ClientIdRateLimiterPolicy : IRateLimiterPolicy<string>
{
    private readonly IServiceProvider _serviceProvider;

    public ClientIdRateLimiterPolicy(IServiceProvider serviceProvider)
    {
        _serviceProvider = serviceProvider;
    }

    public RateLimitPartition<string> GetPartition(HttpContext httpContext)
    {
        var clientId = httpContext.Request.Headers["X-ClientId"].ToString();

        using var scope = _serviceProvider.CreateScope();
        var dbContext = scope.ServiceProvider.GetRequiredService<SampleDbContext>();

        var rateLimit = dbContext.Clients.Where(x => x.Identifier == clientId).Select(x => x.RateLimit).FirstOrDefault();

        return RateLimitPartition.GetConcurrencyRateLimiter(clientId, key => new ConcurrencyRateLimiterOptions
        {
            PermitLimit = rateLimit?.PermitLimit ?? 1
        });
    }
}

Proposed API

public interface IRateLimiterPolicy<TPartitionKey>
{
    Func<OnRejectedContext, CancellationToken, ValueTask>? OnRejected { get; }

-   RateLimitPartition<TPartitionKey> GetPartition(HttpContext httpContext);
    
+   ValueTask<RateLimitPartition<TPartitionKey>> GetPartitionAsync(HttpContext httpContext);
}

Usage Examples

public class ClientIdRateLimiterPolicy : IRateLimiterPolicy<string>
{
    private readonly IServiceProvider _serviceProvider;

    public ClientIdRateLimiterPolicy(IServiceProvider serviceProvider)
    {
        _serviceProvider = serviceProvider;
    }

    public async ValueTask<RateLimitPartition<string>> GetPartitionAsync(HttpContext httpContext)
    {
        var clientId = httpContext.Request.Headers["X-ClientId"].ToString();

        using var scope = _serviceProvider.CreateScope();
        var dbContext = scope.ServiceProvider.GetRequiredService<SampleDbContext>();

        var rateLimit = await redisCache.GetAsync(clientId);
        var rateLimit = await dbContext.Clients.Where(x => x.Identifier == clientId).Select(x => x.RateLimit).FirstOrDefaultAsync();

        return RateLimitPartition.GetConcurrencyRateLimiter(clientId, key => new ConcurrencyRateLimiterOptions
        {
            PermitLimit = rateLimit?.PermitLimit ?? 1
        });
    }
}

Risks

Find a way w/o breaking changes

[halter73]

This started as an edit to my previous comment, but it became big enough to deserve it’s own comment for the folks following along via email.

I think your best bet for now is to read the rate-limit asynchronously before calling into the rate limiting middleware. You can look for the EnableRateLimitingAttribute to make sure you’re not doing this unnecessarily when the endpoint doesn’t have your policy defined. This attribute should be present in the endpoint metadata whether or not it was configured as an attribute on the method or via the RequireRateLimiting() extension method.

// ...

app.Use(async (httpContext, next) =>
{
    var metadata = httpContext.GetEndpoint()?.Metadata;
    if (metadata?.GetMetadata<EnableRateLimitingAttribute>()?.PolicyName == "my-client-id-policy"
        && metadata?.GetMetadata<DisableRateLimitingAttribute>() is null)
    {
        using var scope = httpContext.RequestServices.CreateScope();
        var dbContext = scope.ServiceProvider.GetRequiredService<SampleDbContext>();

        var rateLimit = await dbContext.Clients.Where(x => x.Identifier == clientId).Select(x => x.RateLimit).FirstOrDefaultAsync();
        httpContext.Items["rate-limit"] = rateLimit;
    }

    await next(httpContext);
});

app.UseRateLimiter();

// ...

public class ClientIdRateLimiterPolicy : IRateLimiterPolicy<string>
{
    public Func<OnRejectedContext, CancellationToken, ValueTask>? OnRejected => null;

    public RateLimitPartition<string> GetPartition(HttpContext httpContext)
    {
        var clientId = httpContext.Request.Headers["X-ClientId"].ToString();

        return RateLimitPartition.GetConcurrencyLimiter(clientId, key => new ConcurrencyLimiterOptions
        {
            PermitLimit = (int?)httpContext.Items["rate-limit"] ?? 1
        });
    }
}

The downside of this logic is that it will get run even if the middleware only needed the key and not the rate limiter instance from the factory. The originally proposed API has the same downside though.

Yet another alternative might be to add something like Func<TKey, HttpContext, ValueTask<RateLimiter>>? RateLimitPartition<TKey>.AsyncFactory and updating our callers to use that if it’s set. We’d also need corresponding RateLimitPartition.GetConcurrencyLimiter overloads or similar that took async factories to go with it.

[cristipufu]

I believe that the option to make an async call in cases like this should be added to the framework’s APIs, the workaround is just a workaround