use jwt in rate limiting about aspnetcoreratelimit HOT 5 CLOSED

I have the same question. As a workaround i've used "ClientIdHeader": "Authorization", however the API can be configured to accept JWT tokens via query strings.

The problem is that the client rate limiting middleware is executed before MVC authorisation handles parse JWT token, and so httpContext.User is not set.

It would be nice to have an option for ClientRateLimitMiddleware to be executed after user context is set.

from aspnetcoreratelimit.

I had a similar problem with wanting to use claims-based ratelimiting. My solution was to register the ratelimiting middleware after authentication. In Startup.cs#Configure:

			app.UseAuthentication();
			app.UseClientRateLimiting();

Then using a custom configuration and resolver:

public class ClientIdResolver : IClientResolveContributor
	{
		private readonly IHttpContextAccessor _httpContextAccessor;

		public ClientIdResolver(IHttpContextAccessor httpContextAccessor)
		{
			_httpContextAccessor = httpContextAccessor;
		}
		
		public string ResolveClient()
		{
			return _httpContextAccessor.HttpContext.User.GetPlayerId().ToString();
		}
	}

	{
		public CustomRateLimitConfiguration(IHttpContextAccessor httpContextAccessor,
											IOptions<IpRateLimitOptions> ipOptions,
											IOptions<ClientRateLimitOptions> clientOptions) : base(
			httpContextAccessor, ipOptions, clientOptions)
		{
		}
		
		protected override void RegisterResolvers()
		{
			ClientResolvers.Add(new ClientIdResolver(HttpContextAccessor));
		}
	}```

register the custom configuration using services in `Startup.cs#ConfigureServices`:
`services.AddSingleton<IRateLimitConfiguration, CustomRateLimitConfiguration>();`

from aspnetcoreratelimit.

@Kantis
What do you use as Authorization? Custom middleware? I have custom AuthenticationHandler and a custom AuthorizationHandler and they execute before IClientResolveContributor. Maybe because they are MVC filters, which required to be executed after rate limiter.

Seems like I need to write middleware for Authentication then and use actual handlers just to confirm user.

from aspnetcoreratelimit.

@Kantis
What do you use as Authorization? Custom middleware? I have custom AuthenticationHandler and a custom AuthorizationHandler and they execute before IClientResolveContributor. Maybe because they are MVC filters, which required to be executed after rate limiter.

Seems like I need to write middleware for Authentication then and use actual handlers just to confirm user.

We used claim based authentication using an auth header. We tried to use as much out-of-the-box as possible, so it shouldn't have been any custom middleware, but I'm not active in the project anymore so can't say for sure.

from aspnetcoreratelimit.

This helped me: #82 (comment)

from aspnetcoreratelimit.