Building API Rate Limiting in ASP.NET Core Using .NET Built-In Middleware

Introduction

Modern web APIs must handle traffic responsibly. Without protection, a single misbehaving client can overload your server, impact performance, or even cause downtime. Traditionally, developers relied on third-party libraries or API gateways for rate limiting.

Starting with .NET 7+, ASP.NET Core introduced first-class rate limiting middleware, making it easier than ever to control request flow directly inside your application.

In this article, we’ll explore:

• What rate limiting is

• Why built-in rate limiting matters

• How to implement rate limiting in ASP.NET Core

• Practical examples with policies

What Is Rate Limiting?

Rate limiting restricts how many requests a client can make within a specific time window.

Examples:

• 100 requests per minute per user

• 10 login attempts per minute per IP

• Unlimited requests for internal services

Rate limiting helps:

• Prevent abuse and brute-force attacks

• Improve API stability

• Ensure fair usage across clients

Why Use Built-In Rate Limiting in .NET?

The built-in rate limiter in ASP.NET Core offers:

• High performance (uses System.Threading.RateLimiting)

• No external dependencies

• Tight integration with middleware pipeline

• Policy-based configuration

This makes it production-ready and easy to maintain.

Adding Rate Limiting to an ASP.NET Core API

Step 1: Create a New Web API

dotnet new webapi -n RateLimitDemo

Step 2: Configure Rate Limiting in Program.cs

using System.Threading.RateLimiting;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("FixedPolicy", limiterOptions =>
    {
        limiterOptions.Window = TimeSpan.FromMinutes(1);
        limiterOptions.PermitLimit = 5;
        limiterOptions.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
        limiterOptions.QueueLimit = 2;
    });

    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
});

builder.Services.AddControllers();

var app = builder.Build();

app.UseRateLimiter();

app.MapControllers();

app.Run();

Understanding the Configuration