Rate Limiting in ASP.NET Core — Built-in Algorithms, Policies and Production Gotchas

using Microsoft.AspNetCore.RateLimiting;
using System.Threading.RateLimiting;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllers();

// ── Register the rate limiting services and configure policies ──────────────
builder.Services.AddRateLimiter(rateLimiterOptions =>
{
    // Reject callbacks let you customise the 429 response body and headers.
    rateLimiterOptions.RejectionStatusCode = StatusCodes.Status429TooManyRequests;

    rateLimiterOptions.OnRejected = async (context, cancellationToken) =>
    {
        // Add a Retry-After header so well-behaved clients know when to retry.
        if (context.Lease.TryGetMetadata(MetadataName.RetryAfter, out var retryAfter))
        {
            context.HttpContext.Response.Headers.RetryAfter =
                ((int)retryAfter.TotalSeconds).ToString();
        }

        context.HttpContext.Response.StatusCode = StatusCodes.Status429TooManyRequests;
        await context.HttpContext.Response.WriteAsync(
            "Too many requests. Please slow down.",
            cancellationToken);
    };

    // ── Fixed Window policy: 10 requests per 10-second window per IP ─────────
    rateLimiterOptions.AddFixedWindowLimiter(
        policyName: "FixedWindowPolicy",
        options =>
        {
            options.PermitLimit         = 10;                     // max requests allowed
            options.Window              = TimeSpan.FromSeconds(10); // window duration
            options.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
            options.QueueLimit          = 2;  // allow 2 requests to queue; rest get 429
        });

    // ── Partitioned policy: each IP address gets its OWN sliding window ──────
    rateLimiterOptions.AddSlidingWindowLimiter(
        policyName: "SlidingWindowPerIp",
        options =>
        {
            options.PermitLimit         = 20;
            options.Window              = TimeSpan.FromSeconds(30);
            options.SegmentsPerWindow   = 3;   // divides 30s into 3 × 10s segments
            options.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
            options.QueueLimit          = 0;   // no queuing — reject immediately
        });
});

var app = builder.Build();

// ── UseRateLimiter MUST come after UseRouting but before MapControllers ──────
app.UseRouting();
app.UseRateLimiter();   // <── this is the middleware that does the work
app.UseAuthorization();
app.MapControllers();

app.Run();

using Microsoft.AspNetCore.RateLimiting;
using System.Threading.RateLimiting;

// This file shows ALL four algorithms side-by-side so you can compare them.
// Wire these up inside AddRateLimiter() in Program.cs.

public static class RateLimitPolicies
{
    public const string FixedWindow   = nameof(FixedWindow);
    public const string SlidingWindow = nameof(SlidingWindow);
    public const string TokenBucket   = nameof(TokenBucket);
    public const string Concurrency   = nameof(Concurrency);

    public static void Register(RateLimiterOptions options)
    {
        // ── 1. Fixed Window ──────────────────────────────────────────────────
        // Good for: simple public endpoints where occasional boundary bursts are tolerable.
        options.AddFixedWindowLimiter(FixedWindow, opt =>
        {
            opt.PermitLimit          = 100;                      // 100 reqs per minute
            opt.Window               = TimeSpan.FromMinutes(1);
            opt.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
            opt.QueueLimit           = 10;
        });

        // ── 2. Sliding Window ────────────────────────────────────────────────
        // Good for: search endpoints, user-facing UIs where burst spikes feel bad.
        // SegmentsPerWindow=6 means the 60s window is divided into 6×10s buckets.
        // Requests from the oldest bucket are 'forgotten' as time moves forward.
        options.AddSlidingWindowLimiter(SlidingWindow, opt =>
        {
            opt.PermitLimit          = 100;
            opt.Window               = TimeSpan.FromMinutes(1);
            opt.SegmentsPerWindow    = 6;                        // granularity tradeoff
            opt.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
            opt.QueueLimit           = 5;
        });

        // ── 3. Token Bucket ──────────────────────────────────────────────────
        // Good for: payment processors, upload APIs — burst-friendly but smooth overall.
        // TokensPerPeriod=20 means 20 tokens are added every ReplenishmentPeriod.
        // TokenLimit=50 is the bucket capacity — max burst size.
        options.AddTokenBucketLimiter(TokenBucket, opt =>
        {
            opt.TokenLimit           = 50;                       // bucket capacity
            opt.ReplenishmentPeriod  = TimeSpan.FromSeconds(10);
            opt.TokensPerPeriod      = 20;                       // refill rate
            opt.AutoReplenishment    = true;                     // background timer handles refill
            opt.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
            opt.QueueLimit           = 3;
        });

        // ── 4. Concurrency Limiter ───────────────────────────────────────────
        // Good for: endpoints hitting a DB connection pool or a slow third-party API.
        // This says: max 5 requests can execute at the same time; up to 2 can queue.
        options.AddConcurrencyLimiter(Concurrency, opt =>
        {
            opt.PermitLimit          = 5;                        // max concurrent requests
            opt.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
            opt.QueueLimit           = 2;
        });
    }
}

using Microsoft.AspNetCore.RateLimiting;
using System.Security.Claims;
using System.Threading.RateLimiting;

builder.Services.AddRateLimiter(options =>
{
    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;

    // ── Partitioned policy: anonymous vs authenticated users get different limits ──
    options.AddPolicy(
        policyName: "UserTierPolicy",
        partitioner: httpContext =>
        {
            // Prefer the authenticated user ID as the partition key.
            // Fall back to IP address for anonymous callers.
            var userId = httpContext.User.FindFirstValue(ClaimTypes.NameIdentifier);

            if (!string.IsNullOrEmpty(userId))
            {
                // Authenticated users get a generous token bucket.
                return RateLimitPartition.GetTokenBucketLimiter(
                    partitionKey: $"user:{userId}",   // unique key per user
                    factory: _ => new TokenBucketRateLimiterOptions
                    {
                        TokenLimit          = 200,               // large bucket for auth'd users
                        ReplenishmentPeriod = TimeSpan.FromSeconds(30),
                        TokensPerPeriod     = 50,
                        AutoReplenishment   = true,
                        QueueLimit          = 0
                    });
            }

            // Anonymous callers get a much stricter fixed window per IP.
            var clientIpAddress =
                httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown";

            return RateLimitPartition.GetFixedWindowLimiter(
                partitionKey: $"anon:{clientIpAddress}",
                factory: _ => new FixedWindowRateLimiterOptions
                {
                    PermitLimit          = 10,                   // tight limit for anonymous
                    Window               = TimeSpan.FromSeconds(10),
                    QueueProcessingOrder = QueueProcessingOrder.OldestFirst,
                    QueueLimit           = 0
                });
        });
});

// ── Apply the policy to a specific controller via attribute ─────────────────
[ApiController]
[Route("api/[controller]")]
[EnableRateLimiting("UserTierPolicy")]   // <── applied to every action in this controller
public class ProductsController : ControllerBase
{
    [HttpGet]
    public IActionResult GetAll()
    {
        return Ok(new[] { "Widget A", "Widget B", "Widget C" });
    }

    [HttpGet("{id:int}")]
    [DisableRateLimiting]   // <── opt-out for this specific action (e.g. health/status endpoints)
    public IActionResult GetById(int id)
    {
        return Ok($"Product {id}");
    }
}

using Microsoft.AspNetCore.RateLimiting;
using StackExchange.Redis;
using System.Threading.RateLimiting;

// ── Custom IRateLimiterPolicy backed by Redis for distributed rate limiting ──
// This is the pattern you NEED when running multiple instances in production.
//
// Redis Lua script ensures the increment + expiry check is atomic (no race conditions).
public class RedisFixedWindowPolicy : IRateLimiterPolicy<string>
{
    private readonly IConnectionMultiplexer _redis;
    private readonly ILogger<RedisFixedWindowPolicy> _logger;

    // How many requests are allowed per window
    private const int PermitLimit = 100;
    private static readonly TimeSpan Window = TimeSpan.FromMinutes(1);

    // Lua script: atomically increment and set expiry on first call
    private const string IncrementScript = """
        local current = redis.call('INCR', KEYS[1])
        if current == 1 then
            redis.call('EXPIRE', KEYS[1], ARGV[1])
        end
        return current
        """;

    public RedisFixedWindowPolicy(
        IConnectionMultiplexer redis,
        ILogger<RedisFixedWindowPolicy> logger)
    {
        _redis  = redis;
        _logger = logger;
    }

    // GetPartition is called on EVERY request — keep it fast.
    public RateLimitPartition<string> GetPartition(HttpContext httpContext)
    {
        // Use a claim-based key for authenticated users; IP for anonymous.
        var partitionKey = httpContext.User.Identity?.IsAuthenticated == true
            ? $"rl:user:{httpContext.User.Identity.Name}"
            : $"rl:ip:{httpContext.Connection.RemoteIpAddress}";

        // We return a NoLimiter here and do the actual Redis check in a custom
        // middleware BEFORE this policy runs — see note in callout below.
        // For demonstration we show the Redis check inline via a custom factory.
        return RateLimitPartition.Get(
            partitionKey: partitionKey,
            factory: key => new RedisBackedRateLimiter(key, _redis, _logger));
    }

    public Func<OnRejectedContext, CancellationToken, ValueTask>? OnRejected =>
        async (context, cancellationToken) =>
        {
            context.HttpContext.Response.StatusCode = 429;

            // Expose the reset time so clients can schedule a retry intelligently.
            context.HttpContext.Response.Headers["RateLimit-Limit"]  = PermitLimit.ToString();
            context.HttpContext.Response.Headers["RateLimit-Reset"]  =
                DateTimeOffset.UtcNow.Add(Window).ToUnixTimeSeconds().ToString();

            await context.HttpContext.Response.WriteAsJsonAsync(
                new { error = "rate_limit_exceeded", retryAfterSeconds = (int)Window.TotalSeconds },
                cancellationToken);
        };
}

// ── Register in Program.cs ───────────────────────────────────────────────────
// builder.Services.AddSingleton<IConnectionMultiplexer>(
//     ConnectionMultiplexer.Connect("localhost:6379"));
// builder.Services.AddRateLimiter(opt =>
//     opt.AddPolicy<string, RedisFixedWindowPolicy>("DistributedPolicy"));