Reference
Rate-limit policies
The rate-limit policies AuthEndpoints registers, their limits, and the routes that use them.
All policies partition by client IP address. A rejected request returns 429. Policies take effect only when the pipeline calls UseRateLimiter(). UseAuthEndpoints calls it.
Policies
| Policy constant | Limiter | Limit |
|---|---|---|
AuthEndpoints.Login | Token bucket | 10 tokens. 2 tokens are added every 10 seconds. |
AuthEndpoints.AccountAbuse | Fixed window | 10 requests per minute |
AuthEndpoints.ConfirmIdentity | Fixed window | 20 requests per minute |
AuthEndpoints.Passkey.ObtainOptions | Fixed window | 5 requests per minute |
AuthEndpoints.Passkey.Register | Fixed window | 3 requests per minute |
No policy queues requests. The QueueLimit is 0.
Routes per policy
| Policy | Routes |
|---|---|
AuthEndpoints.Login | Cookie and Identity bearer POST /login, JWT POST /create and POST /refresh, passkey POST /passkeys/login, external GET /login/{provider} and GET /link/{scheme} |
AuthEndpoints.AccountAbuse | POST /register, POST /resendConfirmationEmail, POST /forgotPassword, POST /resetPassword |
AuthEndpoints.ConfirmIdentity | POST /confirmIdentity, POST /confirmIdentity/passkeyOptions |
AuthEndpoints.Passkey.ObtainOptions | POST /passkeys/creationOptions, POST /passkeys/requestOptions, POST /passkeys/register/options |
AuthEndpoints.Passkey.Register | POST /passkeys/register, POST /passkeys/ |
Identity bearer POST /refresh has no rate limit.
Registration
| DI call | Policies it registers |
|---|---|
AddCookieAuthEndpoints | Login, AccountAbuse, ConfirmIdentity |
AddBearerAuthEndpoints | Login, AccountAbuse, ConfirmIdentity |
AddJwtEndpoints | Login, AccountAbuse, ConfirmIdentity |
AddPasskeyEndpoints | Login, AccountAbuse, ConfirmIdentity, Passkey.ObtainOptions, Passkey.Register |
AddExternalAuthEndpoints | Login |
Each policy is registered once, even when several calls add it. The facade makes the matching calls for you.