MNW #032: How To Use Rate Limiting In ASP .NET Core

Read time: 5 minutes

A big thank you to our sponsors who keep this newsletter free to the reader:

Today's issue is sponsored by Rebus Pro. Rebus is a free .NET "service bus", and Rebus Pro is the perfect one-up for serious Rebus users. Use Fleet Manager to get Slack alerts when something fails and retry dead-lettered messages with a click of the mouse.

And by Hasura, an open-source engine that gives instant GraphQL and REST APIs on new or existing SQL Server, enabling teams to ship apps faster.

Rate limiting is a technique used to limit the number of requests to a server or an API.

A limit is introduced within a given time period to prevent server overload and protect against abuse.

In ASP .NET Core 7 we have a built-in rate limiter middleware, that's easy to integrate into your API.

We're going to cover four rate limiting algorithms:

Fixed window
Sliding window
Token bucket
Concurrency

Let's see how we can work with rate limiting.

What Is Rate Limiting?

Rate limiting is all about restricting the number of requests to an API. Usually within a specific time window, or based on some other criteria.

This is practical for a few reasons:

Prevents overloading of servers or applications
Improves security and guards against DDoS attacks
Reduces costs by preventing unnecessary resource usage

In a multi-tenant application, each unique user can have a limitation on the number of API requests.

Configuring Rate Limiting

ASP .NET Core 7 introduced built-in rate limiting middleware in the Microsoft.AspNetCore.RateLimiting namespace.

To add rate limiting in your application you first need to register the rate limiting services:

I suggest updating the RejectionStatusCode to 429 (Too Many Requests) because it's more correct. The default value is 503 (Service Unavailable).

And you also have to apply the RateLimitingMiddleware:

That's everything you'll need.

Let's see the rate limiting algorithms we can use.

Fixed Window Limiter

The AddFixedWindowLimiter method configures a fixed window limiter.

The time window is determined by the Window value.

When a time window expires, a new one starts, and the request limit is reset.

Sliding Window Limiter

The sliding window algorithm is similar to the fixed window, but it introduces segments in a window.

Here's how it works:

Each time window is divided into multiple segments
The window slides one segment each segment interval
The segment interval is (window_time)/(segments_per_window)
When a segment expires, the requests taken in that segment are added to the current segment

The AddSlidingWindowLimiter method configures a sliding window limiter.

Token Bucket Limiter

The token bucket algorithm is similar to the sliding window, but instead of adding back the requests from the expired segment, a fixed number of tokens are added after each replenishment period.

The total number of tokens can never exceed the token limit.

The AddTokenBucketLimiter method configures a token bucket limiter.

When AutoReplenishment is true, an internal timer will execute every ReplenishmentPeriod and replenish the tokens.

Concurrency Limiter

The concurrency limiter is the simplest algorithm, and it just limits the number of concurrent requests.

The AddConcurrencyLimiter method configures a concurrency limiter.

Using Rate Limiting In Your API

Now that we have configured our rate limiting policies, let's see how we can use them in our API.

There are slight differences between controllers and minimal API endpoints, so I'll cover them in separate examples.

Controllers

To add rate limiting on a controller we use the EnableRateLimiting and DisableRateLimiting attributes.

EnableRateLimiting can be applied on the controller or on the individual endpoints.

In the previous example:

All endpoints in the TransactionsController will use a fixed window policy
The GetTransactions endpoint will use a sliding window policy
The GetTransactionById endpoint won't have any rate limiting applied

Minimal APIs

In a minimal API endpoint you can configure the rate limit policy by calling RequireRateLimiting and specifying the policy name.

We're using the token bucket policy in this example.

Closing Thoughts

It's great that we can easily introduce rate limiting in ASP .NET Core.

You can choose from one of the existing rate limiter algorithms:

Fixed window
Sliding window
Token bucket
Concurrency

Here are some resources if you want to learn more about rate limiting:

I'm excited to try out rate limiting in my own projects.

That's all for today.

Have an awesome Saturday!

Whenever you're ready, there are 3 ways I can help you 🎁

To access all of the source code that I use in my YouTube videos support me on Patreon
For more practical & in-depth coding examples subscribe to my YouTube channel
Promote yourself to 14.000+ subscribers by sponsoring this newsletter (booked out 2 months)

You received this email because you subscribed to our list. You can unsubscribe at any time.

Dragise Cvetkovica 2, Niš, 18000, Serbia

MNW #032: How To Use Rate Limiting In ASP .NET Core

MNW #032: How To Use Rate Limiting In ASP .NET Core

What Is Rate Limiting?

Configuring Rate Limiting

Fixed Window Limiter

Sliding Window Limiter

Token Bucket Limiter

Concurrency Limiter

Using Rate Limiting In Your API

Closing Thoughts

Older messages

MNW #031: Implementing The Saga Pattern With Rebus And RabbitMQ

MNW #030: How To Publish MediatR Notifications In Parallel

MNW #029: Creating Data-Driven Tests With xUnit

MNW #028: Using Multiple EF Core DbContexts In a Single Application

MNW #027: How To Apply Functional Programming In C#

You Might Also Like

⏳ 36 Hours Left: Help Get "The Art of Data" Across the Finish Line 🏁

DeveloPassion's Newsletter #180 - Black Friday Week

Meet HackerNoon's Latest Features: Boost Stories with Translations, Speech-to-Text & More

The ultimate holiday gadget gift

Deduplication in Distributed Systems: Myths, Realities, and Practical Solutions

How to know if your data has been exposed

⚙️ Amazon and Anthropic

⚡ THN Recap: Top Cybersecurity Threats, Tools & Tips (Nov 18-24)

Researchers Uncover Malware Using BYOVD to Bypass Antivirus Protections

Post from Syncfusion Blogs on 11/25/2024