Rate Limiting Configuration

Protect your IdentitySuite instance from abuse and excessive API usage with comprehensive rate limiting policies and monitoring

Rate Limiting Configuration

Rate limiting protects IdentitySuite from abuse and excessive API usage by controlling the number of requests clients can make within specific time windows. All rate limiting policies use SlidingWindowRateLimiterOptions to provide flexible and granular control over request throttling.

Rate Limiting Controls:

Rate limiting enabled: Master switch to enable/disable all rate limiting policies
Rate limiting metrics enabled: Enables collection and display of rate limiting statistics and analytics

OIDC Critical Endpoints (High-Risk):

High-risk OIDC endpoints vulnerable to abuse through automated attacks and resource exhaustion. These endpoints handle authentication flows and token generation, making them prime targets for brute force and DoS attacks. Endpoints: /Connect/Authorize, /Connect/Token, /Connect/Verify.

SlidingWindowRateLimiterOptions Parameters:

PermitLimit: Maximum requests allowed (Default: 20)
Window: Time window duration (Default: 5 minutes)
SegmentsPerWindow: Window subdivisions for smoother limiting (Default: 10)
QueueLimit: Queued requests when limit exceeded (Default: 0)
AutoReplenishmentEnable: Automatically replenishes permits as time progresses within the sliding window

OIDC Default Endpoints (Moderate-Risk):

Standard OIDC endpoints with moderate risk exposure. These endpoints handle user session management and profile information, requiring protection against automated scraping and session abuse attacks. Endpoints: /Connect/Logout, /Connect/UserInfo.

SlidingWindowRateLimiterOptions Parameters:

PermitLimit: Maximum requests allowed (Default: 60)
Window: Time window duration (Default: 5 minutes)
SegmentsPerWindow: Window subdivisions for smoother limiting (Default: 10)
QueueLimit: Queued requests when limit exceeded (Default: 0)
AutoReplenishmentEnable: Automatically replenishes permits as time progresses within the sliding window

Global Endpoints (Baseline Protection):

General application endpoints requiring baseline protection against common automated threats. This policy provides default rate limiting for all endpoints not covered by specific OIDC policies, preventing generic DoS attacks and API abuse.

SlidingWindowRateLimiterOptions Parameters:

PermitLimit: Maximum requests allowed (Default: 100)
Window: Time window duration (Default: 5 minutes)
SegmentsPerWindow: Window subdivisions for smoother limiting (Default: 5)
QueueLimit: Queued requests when limit exceeded (Default: 0)
AutoReplenishmentEnable: Automatically replenishes permits as time progresses within the sliding window

IP Address Management:

White Listed IPs:
  • • IP addresses exempt from all rate limiting
  • • Trusted sources and administrative access
  • • Add IP addresses that should never be throttled
Black Listed IPs:
  • • IP addresses completely blocked from access
  • • Known malicious sources and threat actors
  • • Automatically reject all requests from these IPs

Understanding SlidingWindowRateLimiterOptions:

Sliding Window Algorithm: Unlike fixed windows that reset at specific intervals, sliding windows continuously track requests over a moving time period, providing smoother rate limiting without sudden bursts.
PermitLimit: The maximum number of requests allowed within the window period.
Window: The duration of the sliding time window (e.g., 5 minutes, 1 hour).
SegmentsPerWindow: Divides the window into smaller segments for more precise tracking. Higher values provide smoother limiting but use more memory.
QueueLimit: Number of requests to queue when the limit is exceeded. Set to 0 to immediately reject excess requests.
AutoReplenishmentEnable: Automatically makes new permits available as time progresses, rather than waiting for the full window to slide.

Rate Limiting Metrics and Monitoring:

Important: All metrics are stored in memory and are not persistent. Data is lost when the server process restarts, including IIS app pool recycling, application restarts, or server reboots. Metrics are designed for real-time policy evaluation and monitoring.
Real-time Metrics:
  • • Rejection Rate: Percentage of requests being blocked
  • • Unique Clients: Number of distinct IP addresses
  • • Active Policies: Currently enforced rate limit policies
  • • Suspicious Clients: IPs showing potential abuse patterns
Analytics Views:
  • • Statistics Policy: Per-policy performance data
  • • Popular Endpoints: Most frequently accessed endpoints
  • • Client Requests: Top requesting IP addresses
  • • Time Trends: Request patterns over time
Time Views: Last hour, Last day, Last week

Configuration Guidelines:

  • • Test rate limiting policies in a development environment first
  • • Monitor metrics regularly to adjust limits based on actual usage patterns
  • • Consider legitimate high-traffic scenarios when setting limits
  • • White-list trusted IP addresses to prevent accidental blocking
  • • Application restart required for configuration changes to take effect