Implement minimal RateLimitingMiddleware

AspNetCore.sln

@@ -1696,6 +1696,10 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "BuildAfterTargetingPack", "
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "ResultsOfTGenerator", "src\Http\Http.Results\tools\ResultsOfTGenerator\ResultsOfTGenerator.csproj", "{9716D0D0-2251-44DD-8596-67D253EEF41C}"
 EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.AspNetCore.RateLimiting", "src\Middleware\RateLimiting\src\Microsoft.AspNetCore.RateLimiting.csproj", "{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.AspNetCore.RateLimiting.Tests", "src\Middleware\RateLimiting\test\Microsoft.AspNetCore.RateLimiting.Tests.csproj", "{E85FB5AE-49AD-4102-88D1-79A224863DF7}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -10153,6 +10157,38 @@ Global
 		{9716D0D0-2251-44DD-8596-67D253EEF41C}.Release|x64.Build.0 = Release|Any CPU
 		{9716D0D0-2251-44DD-8596-67D253EEF41C}.Release|x86.ActiveCfg = Release|Any CPU
 		{9716D0D0-2251-44DD-8596-67D253EEF41C}.Release|x86.Build.0 = Release|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Debug|arm64.ActiveCfg = Debug|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Debug|arm64.Build.0 = Debug|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Debug|x64.Build.0 = Debug|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Debug|x86.Build.0 = Debug|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Release|Any CPU.Build.0 = Release|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Release|arm64.ActiveCfg = Release|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Release|arm64.Build.0 = Release|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Release|x64.ActiveCfg = Release|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Release|x64.Build.0 = Release|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Release|x86.ActiveCfg = Release|Any CPU
+		{9D5C9ED8-5FCD-416F-9977-D7D4D4DCF49D}.Release|x86.Build.0 = Release|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Debug|arm64.ActiveCfg = Debug|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Debug|arm64.Build.0 = Debug|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Debug|x64.Build.0 = Debug|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Debug|x86.Build.0 = Debug|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Release|Any CPU.Build.0 = Release|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Release|arm64.ActiveCfg = Release|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Release|arm64.Build.0 = Release|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Release|x64.ActiveCfg = Release|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Release|x64.Build.0 = Release|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Release|x86.ActiveCfg = Release|Any CPU
+		{E85FB5AE-49AD-4102-88D1-79A224863DF7}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

eng/ProjectReferences.props

@@ -89,6 +89,7 @@
     <ProjectReferenceProvider Include="Microsoft.AspNetCore.Localization.Routing" ProjectPath="$(RepoRoot)src\Middleware\Localization.Routing\src\Microsoft.AspNetCore.Localization.Routing.csproj" />
     <ProjectReferenceProvider Include="Microsoft.AspNetCore.Localization" ProjectPath="$(RepoRoot)src\Middleware\Localization\src\Microsoft.AspNetCore.Localization.csproj" />
     <ProjectReferenceProvider Include="Microsoft.AspNetCore.MiddlewareAnalysis" ProjectPath="$(RepoRoot)src\Middleware\MiddlewareAnalysis\src\Microsoft.AspNetCore.MiddlewareAnalysis.csproj" />
+    <ProjectReferenceProvider Include="Microsoft.AspNetCore.RateLimiting" ProjectPath="$(RepoRoot)src\Middleware\RateLimiting\src\Microsoft.AspNetCore.RateLimiting.csproj" />
     <ProjectReferenceProvider Include="Microsoft.AspNetCore.ResponseCaching.Abstractions" ProjectPath="$(RepoRoot)src\Middleware\ResponseCaching.Abstractions\src\Microsoft.AspNetCore.ResponseCaching.Abstractions.csproj" />
     <ProjectReferenceProvider Include="Microsoft.AspNetCore.ResponseCaching" ProjectPath="$(RepoRoot)src\Middleware\ResponseCaching\src\Microsoft.AspNetCore.ResponseCaching.csproj" />
     <ProjectReferenceProvider Include="Microsoft.AspNetCore.ResponseCompression" ProjectPath="$(RepoRoot)src\Middleware\ResponseCompression\src\Microsoft.AspNetCore.ResponseCompression.csproj" />

src/Middleware/Middleware.slnf

@@ -76,6 +76,8 @@
       "src\\Middleware\\MiddlewareAnalysis\\samples\\MiddlewareAnalysisSample\\MiddlewareAnalysisSample.csproj",
       "src\\Middleware\\MiddlewareAnalysis\\src\\Microsoft.AspNetCore.MiddlewareAnalysis.csproj",
       "src\\Middleware\\MiddlewareAnalysis\\test\\Microsoft.AspNetCore.MiddlewareAnalysis.Tests.csproj",
+      "src\\Middleware\\RateLimiting\\src\\Microsoft.AspNetCore.RateLimiting.csproj",
+      "src\\Middleware\\RateLimiting\\test\\Microsoft.AspNetCore.RateLimiting.Tests.csproj",
       "src\\Middleware\\ResponseCaching.Abstractions\\src\\Microsoft.AspNetCore.ResponseCaching.Abstractions.csproj",
       "src\\Middleware\\ResponseCaching\\samples\\ResponseCachingSample\\ResponseCachingSample.csproj",
       "src\\Middleware\\ResponseCaching\\src\\Microsoft.AspNetCore.ResponseCaching.csproj",
@@ -115,4 +117,4 @@
       "src\\Servers\\Kestrel\\Transport.Sockets\\src\\Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.csproj"
     ]
   }
-}
+}

src/Middleware/RateLimiting/src/Microsoft.AspNetCore.RateLimiting.csproj

@@ -0,0 +1,20 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <Description>ASP.NET Core middleware for enforcing rate limiting in an application</Description>
+    <TargetFramework>$(DefaultNetCoreTargetFramework)</TargetFramework>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <PackageTags>aspnetcore</PackageTags>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Reference Include="Microsoft.AspNetCore.Http.Abstractions" />
+    <Reference Include="Microsoft.Extensions.Logging.Abstractions" />
+    <Reference Include="Microsoft.Extensions.Options" />
+    <Reference Include="System.Threading.RateLimiting" />
+
+    <Compile Include="$(SharedSourceRoot)ValueStopwatch\*.cs" />
+  </ItemGroup>
+
+</Project>

src/Middleware/RateLimiting/src/NoLimiter.cs

@@ -0,0 +1,36 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Threading.RateLimiting;
+
+namespace Microsoft.AspNetCore.RateLimiting;
+internal class NoLimiter<TResource> : PartitionedRateLimiter<TResource>
+{
+    public override int GetAvailablePermits(TResource resourceID)
+    {
+        return 1;
+    }
+
+    protected override RateLimitLease AcquireCore(TResource resourceID, int permitCount)
+    {
+        return new NoLimiterLease();
+    }
+
+    protected override ValueTask<RateLimitLease> WaitAsyncCore(TResource resourceID, int permitCount, CancellationToken cancellationToken)
+    {
+        return new ValueTask<RateLimitLease>(new NoLimiterLease());
+    }
+}
+
+internal class NoLimiterLease : RateLimitLease
+{
+    public override bool IsAcquired => true;
+
+    public override IEnumerable<string> MetadataNames => new List<string>();
+
+    public override bool TryGetMetadata(string metadataName, out object? metadata)
+    {
+        metadata = null;
+        return false;
+    }
+}

src/Middleware/RateLimiting/src/Properties/AssemblyInfo.cs

@@ -0,0 +1,6 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("Microsoft.AspNetCore.RateLimiting.Tests, PublicKey=0024000004800000940000000602000000240000525341310004000001000100f33a29044fa9d740c9b3213a93e57c84b472c84e0b8a0e1ae48e67a9f8f6de9d5f7f3d52ac23e48ac51801f1dc950abe901da34d2a9e3baadb141a17c77ef3c565dd5ee5054b91cf63bb3c6ab83f72ab3aafe93d0fc3c2348b764fafb0b1c0733de51459aeab46580384bf9d74c4e28164b7cde247f891ba07891c9d872ad2bb")] 

src/Middleware/RateLimiting/src/PublicAPI.Shipped.txt

@@ -0,0 +1 @@
+#nullable enable

src/Middleware/RateLimiting/src/PublicAPI.Unshipped.txt

@@ -0,0 +1,11 @@
+Microsoft.AspNetCore.RateLimiting.RateLimitingExtensions
+Microsoft.AspNetCore.RateLimiting.RateLimitingOptions
+Microsoft.AspNetCore.RateLimiting.RateLimitingOptions.Limiter.get -> System.Threading.RateLimiting.PartitionedRateLimiter<Microsoft.AspNetCore.Http.HttpContext!>!
+Microsoft.AspNetCore.RateLimiting.RateLimitingOptions.Limiter.set -> void
+Microsoft.AspNetCore.RateLimiting.RateLimitingOptions.OnRejected.get -> System.Func<Microsoft.AspNetCore.Http.HttpContext!, System.Threading.RateLimiting.RateLimitLease!, System.Threading.Tasks.Task!>!
+Microsoft.AspNetCore.RateLimiting.RateLimitingOptions.OnRejected.set -> void
+Microsoft.AspNetCore.RateLimiting.RateLimitingOptions.RateLimitingOptions() -> void
+Microsoft.AspNetCore.RateLimiting.RateLimitingOptions.RejectionStatusCode.get -> System.Net.HttpStatusCode
+Microsoft.AspNetCore.RateLimiting.RateLimitingOptions.RejectionStatusCode.set -> void
+static Microsoft.AspNetCore.RateLimiting.RateLimitingExtensions.UseRateLimiting(this Microsoft.AspNetCore.Builder.IApplicationBuilder! app) -> Microsoft.AspNetCore.Builder.IApplicationBuilder!
+static Microsoft.AspNetCore.RateLimiting.RateLimitingExtensions.UseRateLimiting(this Microsoft.AspNetCore.Builder.IApplicationBuilder! app, Microsoft.AspNetCore.RateLimiting.RateLimitingOptions! options) -> Microsoft.AspNetCore.Builder.IApplicationBuilder!

src/Middleware/RateLimiting/src/RateLimitingExtensions.cs

@@ -0,0 +1,48 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.Options;
+
+namespace Microsoft.AspNetCore.RateLimiting;
+
+/// <summary>
+/// Extension methods for the RateLimiting middleware.
+/// </summary>
+public static class RateLimitingExtensions
+{
+    /// <summary>
+    /// Enables rate limiting for the application.
+    /// </summary>
+    /// <param name="app"></param>
+    /// <returns></returns>
+    public static IApplicationBuilder UseRateLimiting(this IApplicationBuilder app)
+    {
+        if (app == null)
+        {
+            throw new ArgumentNullException(nameof(app));
+        }
+
+        return app.UseMiddleware<RateLimitingMiddleware>();
+    }
+
+    /// <summary>
+    /// Enables rate limiting for the application with the given options.
+    /// </summary>
+    /// <param name="app"></param>
+    /// <param name="options"></param>
+    /// <returns></returns>
+    public static IApplicationBuilder UseRateLimiting(this IApplicationBuilder app, RateLimitingOptions options)
+    {
+        if (app == null)
+        {
+            throw new ArgumentNullException(nameof(app));
+        }
+        if (options == null)
+        {
+            throw new ArgumentNullException(nameof(options));
+        }
+
+        return app.UseMiddleware<RateLimitingMiddleware>(Options.Create(options));
+    }
+}

src/Middleware/RateLimiting/src/RateLimitingMiddleware.cs

@@ -0,0 +1,81 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Net;
+using System.Threading.RateLimiting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace Microsoft.AspNetCore.RateLimiting;
+
+/// <summary>
+/// Limits the rate of requests allowed in the application, based on limits set by a user-provided <see cref="PartitionedRateLimiter{TResource}"/>.
+/// </summary>
+internal sealed partial class RateLimitingMiddleware
+{
+    private readonly RequestDelegate _next;
+    private readonly Func<HttpContext, RateLimitLease, Task> _onRejected;
+    private readonly ILogger _logger;
+    private readonly PartitionedRateLimiter<HttpContext> _limiter;
+    private readonly HttpStatusCode _rejectionStatusCode;
+
+    /// <summary>
+    /// Creates a new <see cref="RateLimitingMiddleware"/>.
+    /// </summary>
+    /// <param name="next">The <see cref="RequestDelegate"/> representing the next middleware in the pipeline.</param>
+    /// <param name="logger">The <see cref="ILogger"/> used for logging.</param>
+    /// <param name="options">The options for the middleware.</param>
+    public RateLimitingMiddleware(RequestDelegate next, ILogger<RateLimitingMiddleware> logger, IOptions<RateLimitingOptions> options)
+    {
+        _next = next ?? throw new ArgumentNullException(nameof(next));
+
+        if (logger == null)
+        {
+            throw new ArgumentNullException(nameof(logger));
+        }
+
+        _logger = logger;
+        _limiter = options.Value.Limiter;
+        _onRejected = options.Value.OnRejected;
+        _rejectionStatusCode = options.Value.RejectionStatusCode;
+    }
+
+    // TODO - EventSource?
+    /// <summary>
+    /// Invokes the logic of the middleware.
+    /// </summary>
+    /// <param name="context">The <see cref="HttpContext"/>.</param>
+    /// <returns>A <see cref="Task"/> that completes when the request leaves.</returns>
+    public async Task Invoke(HttpContext context)
+    {
+        using var lease = await TryAcquireAsync(context);
+        if (lease.IsAcquired)
+        {
+            await _next(context);
+        }
+        else
+        {
+            RateLimiterLog.RequestRejectedLimitsExceeded(_logger);
+            context.Response.StatusCode = (int)_rejectionStatusCode;
+            await _onRejected(context, lease);
+        }
+    }
+
+    private ValueTask<RateLimitLease> TryAcquireAsync(HttpContext context)
+    {
+        var lease = _limiter.Acquire(context);
+        if (lease.IsAcquired)
+        {
+            return ValueTask.FromResult(lease);
+        }
+
+        return _limiter.WaitAsync(context, cancellationToken: context.RequestAborted);
+    }
+
+    private static partial class RateLimiterLog
+    {
+        [LoggerMessage(1, LogLevel.Debug, "Rate limits exceeded, rejecting this request with a '503 server not available' error", EventName = "RequestRejectedLimitsExceeded")]
+        internal static partial void RequestRejectedLimitsExceeded(ILogger logger);
+    }
+}

src/Middleware/RateLimiting/src/RateLimitingOptions.cs

@@ -0,0 +1,45 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Net;
+using System.Threading.RateLimiting;
+using Microsoft.AspNetCore.Http;
+
+namespace Microsoft.AspNetCore.RateLimiting;
+
+/// <summary>
+/// Specifies options for the rate limiting middleware.
+/// </summary>
+public sealed class RateLimitingOptions
+{
+    // TODO - Provide a default?
+    private PartitionedRateLimiter<HttpContext> _limiter = new NoLimiter<HttpContext>();
+    private Func<HttpContext, RateLimitLease, Task> _onRejected = (context, lease) =>
+    {
+        return Task.CompletedTask;
+    };
+
+    /// <summary>
+    /// Gets or sets the <see cref="PartitionedRateLimiter{TResource}"/>
+    /// </summary>
+    public PartitionedRateLimiter<HttpContext> Limiter
+    {
+        get => _limiter;
+        set => _limiter = value ?? throw new ArgumentNullException(nameof(value));
+    }
+
+    /// <summary>
+    /// Gets or sets a <see cref="Func{HttpContext, RateLimitLease, Task}"/> that handles requests rejected by this middleware.
+    /// </summary>
+    public Func<HttpContext, RateLimitLease, Task> OnRejected
+    {
+        get => _onRejected;
+        set => _onRejected = value ?? throw new ArgumentNullException(nameof(value));
+    }
+
+    /// <summary>
+    /// Gets or sets the <see cref="HttpStatusCode"/> to set on the response when a request is rejected.
+    /// Defaults to <see cref="HttpStatusCode.ServiceUnavailable"/>.
+    /// </summary>
+    public HttpStatusCode RejectionStatusCode { get; set; } = HttpStatusCode.ServiceUnavailable;
+}

src/Middleware/RateLimiting/test/Microsoft.AspNetCore.RateLimiting.Tests.csproj

@@ -0,0 +1,11 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>$(DefaultNetCoreTargetFramework)</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Reference Include="Microsoft.AspNetCore.Http" />
+    <Reference Include="Microsoft.AspNetCore.RateLimiting" />
+  </ItemGroup>
+</Project>