AspNetCoreRateLimit on Azure

Question

I am struggling with getting the package AspNetCoreRateLimit version 4.0.2 to work when hosting a Blazor WebAsssembly project in Azure.

The solution has been developed in Visual studio 2022 and is made up of 5 individual projects, where one of them is a standard API project. It is based on the net6.0 framework. I have a startup.cs configuration and a RateLimitingMiddleware class used to setup the rate limits and the configuration.

Startup.cs:

 public void ConfigureServices(IServiceCollection services)
    {
        services.AddRateLimiting();
        services.AddHsts(options =>
        {
            options.Preload = true;
            options.IncludeSubDomains = true;
            options.MaxAge = TimeSpan.FromDays(365);
        });

        services.AddDbContext<ApplicationDbContext>(options =>
        {
            options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"),
                sqlServerOptionsAction: sqlOptions =>
                {
                    sqlOptions.EnableRetryOnFailure(
                        maxRetryCount: 10,
                        maxRetryDelay: TimeSpan.FromSeconds(30),
                        errorNumbersToAdd: null);
                });
        }, ServiceLifetime.Transient, ServiceLifetime.Singleton);

        services.AddAutoMapper(typeof(Startup));
....
}

 public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseRateLimiting();

        if (env.IsDevelopment())
        {
            app.UseWebAssemblyDebugging();
            app.UseSwagger();
            
        }
        else
        {
            app.UseExceptionHandler("/Error"); 
        }

        app.UseHsts();
...
}

RateLimitingMiddleware.cs

internal static class RateLimitingMiddleware
{
    internal static IServiceCollection AddRateLimiting(this IServiceCollection services)
    {
        // Used to store rate limit counters and ip rules
        services.AddOptions();
        services.AddMemoryCache();
        services.Configure<ClientRateLimitOptions>(options =>
        {
            options.EnableEndpointRateLimiting = true;

            //options.RealIpHeader = "X-Real-IP";
            options.ClientIdHeader = "authorization";
            //options.EndpointWhitelist = new List<string> { "get:/_framework/*", "get:/_content/*", "*:/lib/*", "*:/css/*", "*:/js/", "*:/appsettings.json", "*:/images/" };
            options.GeneralRules = new List<RateLimitRule>
            {
                new RateLimitRule
                {
                    Endpoint="*:/api/*",
                    Period = "15m",
                    Limit=30
                },
                new RateLimitRule
                {
                    Endpoint="*:/api/*",
                    Period = "12h",
                    Limit=20000
                },
                new RateLimitRule
                {
                    Endpoint="*:/api/*",
                    Period = "7d",
                    Limit=1000000
                }
            };
        });
        services.AddInMemoryRateLimiting();
        // Inject Counter and Store Rules
        services.AddSingleton<IClientPolicyStore, MemoryCacheClientPolicyStore>();
        services.AddSingleton<IRateLimitCounterStore, MemoryCacheRateLimitCounterStore>();

        services.AddSingleton<IClientPolicyStore, DistributedCacheClientPolicyStore>();
        services.AddSingleton<IRateLimitCounterStore, DistributedCacheRateLimitCounterStore>();

        services.AddSingleton<IRateLimitConfiguration, RateLimitConfiguration>();
        services.AddSingleton<IProcessingStrategy, AsyncKeyLockProcessingStrategy>();
        //services.AddSingleton<IRateLimitConfiguration, CustomRateLimitConfiguration>();
        //

        // Return the services
        return services;
    }
    internal static IApplicationBuilder UseRateLimiting(this IApplicationBuilder app)
    {

        var ipPolicyStore = app.ApplicationServices.GetRequiredService<IIpPolicyStore>();
        ipPolicyStore.SeedAsync().GetAwaiter().GetResult();
        var clientPolicyStore = app.ApplicationServices.GetRequiredService<IClientPolicyStore>();
        clientPolicyStore.SeedAsync().GetAwaiter().GetResult();

        app.UseClientRateLimiting();
        app.UseIpRateLimiting();
        return app;
    }
}

With the above configuration the api calls are being limited when testing localhost and using Postman. However when the api is uploaded to our Azure environment the rules are not being implemented correctly.

As stated in the rule defined in the middelware I would like to use the authorization token to limit the number of count the number of requests but cannot get it to work.

I hope that someone has dealt with the same issue and can see where I am going wrong?

Thanks,

Answer 1

Problem solved. Wrong ratelimitheader. Should be CLIENT-IP.