UserCodeRateLimiter Class
Abblix.Oidc.Server
Abblix.Oidc.Server.Features.DeviceAuthorization
UserCodeRateLimiter Class
Implements rate limiting for user code verification attempts to prevent brute force attacks. Uses exponential backoff and per-IP rate limiting as recommended by RFC 8628 Section 5.2.
public class UserCodeRateLimiter : Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter
Inheritance System.Object → UserCodeRateLimiter
Implements IUserCodeRateLimiter
Constructors
UserCodeRateLimiter(ILogger<UserCodeRateLimiter>, IEntityStorage, IEntityStorageKeyFactory, TimeProvider, IOptions<OidcOptions>) Constructor
Implements rate limiting for user code verification attempts to prevent brute force attacks. Uses exponential backoff and per-IP rate limiting as recommended by RFC 8628 Section 5.2.
public UserCodeRateLimiter(Microsoft.Extensions.Logging.ILogger<Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter> logger, Abblix.Oidc.Server.Features.Storages.IEntityStorage storage, Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory keyFactory, System.TimeProvider timeProvider, Microsoft.Extensions.Options.IOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions> options);
Parameters
logger Microsoft.Extensions.Logging.ILogger<UserCodeRateLimiter>
Logger for security events.
storage IEntityStorage
The storage service for persisting rate limit state.
keyFactory IEntityStorageKeyFactory
The factory for generating storage keys.
timeProvider System.TimeProvider
Provides access to the current time.
options Microsoft.Extensions.Options.IOptions<OidcOptions>
Configuration options containing device authorization settings.
Methods
UserCodeRateLimiter.CheckAsync(string, string) Method
Checks if a verification attempt should be allowed for the given user code and client identifier. Implements exponential backoff and per-IP rate limiting to prevent brute force attacks.
public System.Threading.Tasks.Task<Abblix.Utils.Result<bool,System.TimeSpan>> CheckAsync(string userCode, string clientIdentifier);
Parameters
userCode System.String
The user code being verified.
clientIdentifier System.String
The client identifier (IP address or other identifier).
Implements CheckAsync(string, string)
Returns
System.Threading.Tasks.Task<Abblix.Utils.Result<System.Boolean,System.TimeSpan>>
A Abblix.Utils.Result<> containing:
- Success (true): The verification attempt is allowed to proceed.
- Failure (System.TimeSpan): The attempt is rate limited; the value indicates the duration
the client must wait before retrying (Retry-After).
UserCodeRateLimiter.RecordFailureAsync(string, string) Method
Records a failed verification attempt for rate limiting purposes.
public System.Threading.Tasks.Task RecordFailureAsync(string userCode, string clientIdentifier);
Parameters
userCode System.String
The user code that failed verification.
clientIdentifier System.String
The client identifier (IP address or other identifier).
Implements RecordFailureAsync(string, string)
Returns
UserCodeRateLimiter.RecordSuccessAsync(string, string) Method
Records a successful verification to reset rate limiting counters.
public System.Threading.Tasks.Task RecordSuccessAsync(string userCode, string clientIdentifier);
Parameters
userCode System.String
The user code that was successfully verified.
clientIdentifier System.String
The client identifier (IP address or other identifier).
Implements RecordSuccessAsync(string, string)