1.0.8

Features

• added per Week rate limit that can be used with Redis, Azure caching or any other caching service that can hold data more then 24h
• added TracingThrottleLogger to publish throttling messages to the native web api ITraceWritter if one is supplied
• allow override of throttle key computation ComputeThrottleKey
• allow override of HTTP Status code when requests are rate limited

Refactoring

• short-circut large control statements
• move whitelist checking to separate method
• use member ThrottlePolicy instead of passing it around
• RequestIndentity renamed to RequestIdentity

IP range policy

The ThrottlePolicy IpRules and IpWhitelist now supports defining IP v4 and v6 ranges.

config.MessageHandlers.Add(new ThrottlingHandler()
{
    Policy = new ThrottlePolicy(perSecond: 1, perMinute: 20, perHour: 30, perDay: 35)
    {
        IpThrottling = true,
        IpRules = new Dictionary<string, RateLimits>
        { 
            { "::1/10", new RateLimits { PerSecond = 2 } },
            { "192.168.2.0 - 192.168.2.10", new RateLimits { PerMinute = 30 } }
        },
        IpWhitelist = new List<string> { "192.168.1.0/24", "192.168.0.0/255.255.255.0" }
    },
    Repository = new CacheRepository()
});

For more information on defining IP ranges check out jsakamoto/ipaddressrange

Ensuring thread safety

In order to ensure thread safety, the ThrottleCounter object is now of type struct and all CRUD operations are done with locking.

static readonly object _processLocker = new object();
private ThrottleCounter ProcessRequest(
    ThrottlePolicy throttlePolicy, 
    RequestIndentity throttleEntry, 
    TimeSpan timeSpan, 
    RateLimitPeriod period, out string id)
{
    var throttleCounter = new ThrottleCounter();
    throttleCounter.Timestamp = DateTime.UtcNow;
    throttleCounter.TotalRequests = 1;

    id = "throttle";

    //computed request unique id from IP, client key, url and period

    //get the hash value of the computed id
    var hashId = ComputeHash(id);

    //serial reads and writes
    lock (_processLocker)
    {
        var entry = Repository.FirstOrDefault(hashId);
        if (entry.HasValue)
        {
            //entry has not expired
            if (entry.Value.Timestamp + timeSpan >= DateTime.UtcNow)
            {
                //increment request count
                var totalRequests = entry.Value.TotalRequests + 1;

                //deep copy
                throttleCounter = new ThrottleCounter
                {
                    Timestamp = entry.Value.Timestamp,
                    TotalRequests = totalRequests
                };
            }
        }

        //stores: id (string) - timestamp (datetime) - total (long)
        Repository.Save(hashId, throttleCounter, timeSpan);
    }

    return throttleCounter;
}

Initial release

WebApiThrottle package is available on NuGet at https://www.nuget.org/packages/WebApiThrottle/

To install ASP.NET Web API throttling handler, run the following command in the Package Manager Console

PM> Install-Package WebApiThrottle