[Question] About Rate limiting in YARP

[ezepizarro]

Is rate limiting planned to be part of the project? If not, any suggestion on how to implement it per route?
Thanks!

[Tratcher]

Can you clarify what you want to rate limit? All requests? Requests per user? Requests per route/cluster/destination?

ASP.NET Core has a general concurrency limiting component that could be used with YARP. There are some improvements in progress that would make it even better (dotnet/aspnetcore#20835). I don't anticipate YARP needing to develop it's own implementation, but more likely integrate with an existing one list this.

[ezepizarro]

I was thinking on having something configurable that we can add per route/cluster/destination, like we are doing right now with Authentication and Authorization.
Probably controlling the rate of request per IP address or client ID.

[ezepizarro]

Did I answer your question @Tratcher? Any follow up on this?
Thanks

[Tratcher]

dotnet/aspnetcore#20835 would already cover per-route throttling. However it doesn't handle per-client throttling, that would be a server or middleware feature you'd plug in before routing/YARP. I'd argue that those are two different scenarios and trying to combine them makes them less effective. You want to gauge now noisy a client is being based on their traffic to all endpoints, not a specific endpoint. And throttling per route is to avoid overwhelming destination resources so you want that to encompass all traffic to that route, not per user.

In short, most of this is an ASP.NET Core feature ask, not a YARP ask.

[WeihanLi]

Maybe this project would help https://github.com/stefanprodan/AspNetCoreRateLimit
We implement our rate limit feature based on this.

[ezepizarro]

Thanks to both for the answers.

[Kahbazi]

I also implement a library which you can add different throttling per route. You might find it useful.
Https://github.com/kahbazi/ThrottlR