Hey! I’m having a slight issue with Ktor using Rate Limiters and Bearer Authentication. I have my r...

# ktor

[Tech]

Hey! I’m having a slight issue with Ktor using Rate Limiters and Bearer Authentication.

I have my rate limiter and authentication setup and in the route I define them like this,

routing {
  rateLimiter(/*name*/) {
    authentication {
      /*route defs*/
    }
  }
}

Which is fine however, I want the Rate Limiter to run first before authentication to prevent brute force attacks on the key.
Even if I switch the order authentication runs first.

Is there a way to fix this?

[Aleksei Tirman [JB]]

I can't find an easy fix because the AuthenticationInterceptors plugin intercepts the route's pipeline in a later phase than the one which is intercepted by the RateLimitInterceptors plugin.

[Tech]

Shoot, is there a way to manually edit the order of which interceptor gets ran?

[Aleksei Tirman [JB]]

No

[Tech]

Am I able to make my own interceptor that runs before Auth that just hooks into Rate Limiter?

[Aleksei Tirman [JB]]

What do you mean by hooking into Rate Limiter?

[Tech]

Do you think it’d be possible to write my own interceptor that runs before Auth that just uses Rate Limiter internally

[Tech]

Do Interceptors have some sort of priority system I can use to run the rate limiter before Authentication?

[Aleksei Tirman [JB]]

Unfortunately, that's no possible. Can you please file an issue about the order problem?

[Tech]

I managed to get it to work with a global rate limiter, I’ll file an issue when I’m back to my setup