Rate Limiting & Throttling Middleware in ASP.NET Core

💡 Concept Name

Rate Limiting Middleware

📘 Quick Intro

Rate limiting restricts how often a user or client can hit your API in a given period. ASP.NET Core 7+ includes built-in middleware for this to help prevent abuse and ensure fair usage.

🔧 Technical Explanation

ASP.NET Core 7 introduced built-in middleware via Microsoft.AspNetCore.RateLimiting. It supports multiple algorithms like:

• Fixed Window: X requests per time window
• Sliding Window: Rolling period calculation
• Token Bucket: Tokens refill over time
• Concurrency Limit: Limits simultaneous requests

Policies are defined in Program.cs and applied globally or per-endpoint using [EnableRateLimiting("policyName")].

💻 Real Code Example

// Program.cs (.NET 7+)
builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("fixed", config =>
    {
        config.Window = TimeSpan.FromSeconds(10);
        config.PermitLimit = 5;
        config.QueueLimit = 2;
        config.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
    });
});

var app = builder.Build();

app.UseRateLimiter();

app.MapGet("/api/data", () => "Throttled endpoint")
   .RequireRateLimiting("fixed");

app.Run();