Introduction
When you build a modern ASP.NET Core 10 Web API, one of the most important things to think about is how to protect your API from too many requests. If a large number of users, bots, or automated scripts start sending requests at the same time, your server can slow down, consume too many resources, or even stop working.
This is where rate limiting in ASP.NET Core 10 becomes very useful.
Rate limiting helps you control how many requests a client (user, browser, or system) can send to your API within a specific time period. The good news is that ASP.NET Core 10 provides built-in rate limiting middleware, so you do not need any third-party libraries.
In this detailed guide, you will learn how to implement rate limiting in ASP.NET Core 10 step by step using simple language, real examples, and best practices.
What is Rate Limiting?
Rate limiting is a technique used in API development to control how frequently a client can access your API.
In simple words, it means:
You define a limit (for example, 5 requests)
You define a time period (for example, 10 seconds)
If the client exceeds this limit, further requests are temporarily blocked
For example:
A user can call your API only 10 times per minute
After that, the API will return an error (HTTP 429 - Too Many Requests)
This concept is very important for API security, performance optimization, and scalability in ASP.NET Core applications.
Why Use Built-in Rate Limiting in ASP.NET Core 10?
ASP.NET Core 10 includes a powerful built-in rate limiting system that is easy to configure and highly efficient.
Here are some strong reasons to use it:
No third-party dependency: You do not need external NuGet packages
Better performance: Optimized by Microsoft for high-speed APIs
Simple configuration: Easy to set up in Program.cs
Multiple strategies supported: Fixed window, sliding window, token bucket, concurrency limiter
Production-ready: Suitable for real-world scalable APIs
Using built-in rate limiting also helps improve API reliability, backend stability, and user experience.
Step 1: Create a New ASP.NET Core 10 Web API Project
First, create a new ASP.NET Core Web API project using the .NET CLI.
dotnet new webapi -n RateLimitingDemo
cd RateLimitingDemo
This command creates a ready-to-use API project with basic configuration.
Step 2: Add Rate Limiting Services
Now, we need to register rate limiting services in the dependency injection container.
Open Program.cs and add the following configuration:
using System.Threading.RateLimiting;
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddRateLimiter(options =>
{
options.AddFixedWindowLimiter("fixed", opt =>
{
opt.PermitLimit = 5; // Maximum 5 requests
opt.Window = TimeSpan.FromSeconds(10); // per 10 seconds
opt.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
opt.QueueLimit = 2;
});
});
Explanation (in simple words)
PermitLimit = 5 → Only 5 requests are allowed
Window = 10 seconds → Time duration for those requests
QueueLimit = 2 → Extra requests will wait in queue (max 2)
OldestFirst → Older requests are processed first
This configuration is ideal for basic API rate limiting in ASP.NET Core 10.
Step 3: Enable Rate Limiting Middleware
After configuring services, you need to enable the rate limiting middleware in the HTTP pipeline.
var app = builder.Build();
app.UseRateLimiter();
app.MapGet("/", () => "Hello World!")
.RequireRateLimiting("fixed");
app.Run();
Explanation
Now your API endpoint is protected with rate limiting.
Step 4: Test Rate Limiting in ASP.NET Core API
Run your API:
dotnet run
Now send multiple requests using browser, Postman, or curl:
curl http://localhost:5000/
What will happen?
This confirms that your ASP.NET Core 10 rate limiting implementation is working correctly.
Understanding Fixed Window Rate Limiting
Fixed window is the simplest rate limiting strategy.
How it works
Time is divided into fixed blocks (for example, 10 seconds)
Requests are counted inside that block
Once the limit is reached, further requests are rejected
After the window resets, requests are allowed again
Real-life example
Imagine a ticket counter:
This method is easy to implement and works well for simple API traffic control.
Other Built-in Rate Limiting Strategies in ASP.NET Core 10
ASP.NET Core 10 supports multiple advanced strategies. Let’s understand them in simple terms.
Sliding Window Rate Limiter
options.AddSlidingWindowLimiter("sliding", opt =>
{
opt.PermitLimit = 10;
opt.Window = TimeSpan.FromSeconds(10);
opt.SegmentsPerWindow = 2;
});
Explanation
Sliding window divides time into smaller segments instead of fixed blocks.
More smooth control of traffic
Avoids sudden bursts at reset time
Better for real-time APIs
This is useful for high-traffic ASP.NET Core APIs.
Token Bucket Rate Limiter
options.AddTokenBucketLimiter("token", opt =>
{
opt.TokenLimit = 10;
opt.QueueLimit = 2;
opt.ReplenishmentPeriod = TimeSpan.FromSeconds(5);
opt.TokensPerPeriod = 5;
opt.AutoReplenishment = true;
});
Explanation
Think of tokens like credits:
Each request consumes one token
Tokens are refilled over time
Allows short bursts of traffic
Best for:
Concurrency Limiter
options.AddConcurrencyLimiter("concurrent", opt =>
{
opt.PermitLimit = 2;
opt.QueueLimit = 2;
});
Explanation
This limiter controls how many requests can run at the same time.
Useful for:
CPU-heavy operations
Database-intensive APIs
Applying Rate Limiting Globally
If you want to apply rate limiting to all endpoints:
app.UseRateLimiter();
app.MapControllers().RequireRateLimiting("fixed");
This ensures global API protection in ASP.NET Core 10.
Customizing Rate Limit Response
You can customize the response when a request is rejected.
options.OnRejected = async (context, token) =>
{
context.HttpContext.Response.StatusCode = 429;
await context.HttpContext.Response.WriteAsync("Too many requests. Please try again later.");
};
This improves user experience and API usability.
Best Practices for Rate Limiting in ASP.NET Core
To build a scalable and secure API, follow these best practices:
Use different rate limits for different endpoints
Apply stricter limits on sensitive APIs (login, payments)
Combine rate limiting with authentication and authorization
Monitor API usage and logs regularly
Avoid setting very low limits (can affect real users)
These practices help in building secure, scalable, and production-ready ASP.NET Core APIs.
Real-World Use Cases of Rate Limiting
Login API Protection
Public API Protection
Payment APIs
These scenarios show how rate limiting improves API security and performance.
Summary
Rate limiting in ASP.NET Core 10 is a powerful built-in feature that helps you control API traffic, prevent abuse, and improve performance without using any third-party libraries. By using strategies like fixed window, sliding window, token bucket, and concurrency limiter, you can design a secure and scalable Web API. With proper configuration and best practices, you can ensure your ASP.NET Core API remains fast, reliable, and protected against excessive usage, making it suitable for real-world production environments.