Rate limit rules based on whether or not a request is to an endpoint that needs authentication

Hello,

I was wondering if I could get some help with/pointers for implementing rate limiting based on whether or not a request is hitting an api endpoint that needs authentication?

I thought I could add a GeneralRules section to my appsettings.json file, where I start off with with the first rule targeting * and then get more specific, and override it, but it doesnt seem to work :

                {
			"Endpoint": "*",
			"Period": "1h",
			"Limit": 60
		},
		{
			"Endpoint": "*:/my-non-authenticated-endpoint",
			"Period": "1h",
			"Limit": 120
		},

So that by default all my endpoints except for my-non-authenticated-endpoint would have the first rule, and my-non-authenticated-endpoint would have my second rule, but it doesnt seem to work that way? or do I have bad rules? I’m going off of IpRateLimiting with Redis, if it makes a difference.

[dupuis2387]

Sorry, i was being dense. I got what I needed by using

app.UseWhen(x => x.User.Identity.IsAuthenticated, builder => builder.UseClientRateLimiting()); app.UseWhen(x => !x.User.Identity.IsAuthenticated, builder => app.UseIpRateLimiting());

and configuring both ClientRateLimiting and IpRateLimiting settings in my appSettings.json file

[manisha201301]

@dupuis2387 d Did you explored if there any way to override ResolveClientAsync(HttpContext httpContext) to use custom-client-id or ip-address based on a if-else condition?