[identity] Add per-property partitioning to rate limiter#963
[identity] Add per-property partitioning to rate limiter#963
Conversation
Introduce PartitionByProperty to RateLimiterEndpointRule, enabling rate limiting based on a specific request body property (e.g., email) instead of just user or IP. Update partition key logic to extract values from user claims, form data, or JSON payloads, with fallback to IP/host. This enhances flexibility, supporting scenarios like per-email rate limiting for unauthenticated users.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Adds support for configuring rate-limit partitions based on a request-body property (in addition to the existing user-claim / IP / host fallback), enabling scenarios like per-email throttling for unauthenticated endpoints.
Changes:
- Adds
PartitionByPropertytoRateLimiterEndpointRuleto drive per-property partitioning. - Updates rate limiter policy setup to compute a partition key via a new helper that inspects claims, form fields, or JSON bodies, falling back to IP/host.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
src/Indice.AspNetCore/Extensions/RateLimiterExtensions.cs |
Replaces the partition key expression with a helper that can extract a configured body property (form/JSON) with fallback behavior. |
src/Indice.AspNetCore/Configuration/RateLimiterOptions.cs |
Adds PartitionByProperty configuration option to endpoint rule model with XML documentation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
…ce-co/Indice.Platform into feature/identity/rate-limit
Added PartitionStrategy to RateLimiterEndpointRule, enabling rate limiting by IP, user, or request property. Updated CustomPolicyFactory and related methods to support multiple rules per policy. Refactored partition key extraction logic for improved efficiency and configurability. Service registration updated to handle new rule structure.
There was a problem hiding this comment.
Pull request overview
Adds support for rate limiting partitioned by a request-body property (e.g., email) in addition to the existing user/IP-based partitioning, to enable more flexible throttling for unauthenticated scenarios in the Identity stack.
Changes:
- Extend
RateLimiterEndpointRulewithPartitionByPropertyandPartitionStrategy(plus newRateLimiterPartitionStrategyenum). - Update rate limiter partition-key selection to optionally extract a value from form data or JSON payloads (with IP/host fallback).
- Change
CustomPolicyFactoryto return a list of endpoint rules and update Identity’s default policy factory accordingly.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.
| File | Description |
|---|---|
| src/Indice.Features.Identity.Server/Extensions/ServiceCollectionExtensions.cs | Updates Identity rate limiter policy factory to return a list of rules per policy. |
| src/Indice.AspNetCore/Extensions/RateLimiterExtensions.cs | Implements partition key selection strategy and request property extraction logic (form/JSON). |
| src/Indice.AspNetCore/Configuration/RateLimiterOptions.cs | Adds new rule properties + enum and changes custom policy factory to return multiple rules. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Introduce PartitionByProperty to RateLimiterEndpointRule, enabling rate limiting based on a specific request body property (e.g., email) instead of just user or IP. Update partition key logic to extract values from user claims, form data, or JSON payloads, with fallback to IP/host. This enhances flexibility, supporting scenarios like per-email rate limiting for unauthenticated users.