Is Rate Limiting middleware before or after Authentication one?

[osmansonmez]

I want to use Rate Limiting but I want to take RequestId from claims. I see RateLimiting handler runs before authentication handler and ClaimsToHeadersMiddleware handler. I think we should change order RateLimiting and authentication . I don't trust clear header value. Client can change ClientId value always and make request to server and can break Rate Limiting control. I want to take RequestID from in to the claims after authentication.

How can we do?

[TomPallister]

@osmansonmez yes this makes sense I think, I would accept a PR for this but don't have time to do the work myself atm. I will mark this issue as a new feature.

[harindaka]

This really needs to be addressed. ETA anyone? At least it this should be mentioned in the documentation that this can be exploited to launch a dos attack on a valid client in its current state (mark as experimental maybe?).

[raman-m]

Ho-ho-ho! 💥

[raman-m]

Mr. Hemal,
Are you cool hazker from New Zealand? 😄

[raman-m]

@osmansonmez wrote on Oct 15, 2018

Hi Osman!
I've converted your original issue to this Idea discussion.
Are you still with Ocelot?