IUserCodeRateLimiter Interface
Abblix.Oidc.Server
Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces
IUserCodeRateLimiter Interface
Defines the contract for rate limiting user code verification attempts to prevent brute force attacks. Per RFC 8628 Section 5.2, implementations SHOULD implement rate limiting to prevent abuse.
public interface IUserCodeRateLimiter
Derived
↳ UserCodeRateLimiter
Methods
IUserCodeRateLimiter.CheckAsync(string, string) Method
Checks if a verification attempt should be allowed for the given user code and client identifier. Implements exponential backoff and per-IP rate limiting to prevent brute force attacks.
System.Threading.Tasks.Task<Abblix.Utils.Result<bool,System.TimeSpan>> CheckAsync(string userCode, string clientIdentifier);
Parameters
userCode System.String
The user code being verified.
clientIdentifier System.String
The client identifier (IP address or other identifier).
Returns
System.Threading.Tasks.Task<Abblix.Utils.Result<System.Boolean,System.TimeSpan>>
A Abblix.Utils.Result<> containing:
- Success (true): The verification attempt is allowed to proceed.
- Failure (System.TimeSpan): The attempt is rate limited; the value indicates the duration
the client must wait before retrying (Retry-After).
IUserCodeRateLimiter.RecordFailureAsync(string, string) Method
Records a failed verification attempt for rate limiting purposes.
System.Threading.Tasks.Task RecordFailureAsync(string userCode, string clientIdentifier);
Parameters
userCode System.String
The user code that failed verification.
clientIdentifier System.String
The client identifier (IP address or other identifier).
Returns
IUserCodeRateLimiter.RecordSuccessAsync(string, string) Method
Records a successful verification to reset rate limiting counters.
System.Threading.Tasks.Task RecordSuccessAsync(string userCode, string clientIdentifier);
Parameters
userCode System.String
The user code that was successfully verified.
clientIdentifier System.String
The client identifier (IP address or other identifier).