Introduction

APIs are the backbone of modern web applications, mobile apps, and cloud services. As the number of users grows, APIs receive more requests, making them vulnerable to abuse, excessive traffic, and denial-of-service attacks. Without proper controls, a single client can consume too many resources and affect the performance of the entire application.

Rate limiting is an effective way to protect your APIs by controlling how many requests a client can make within a specific time period. ASP.NET Core includes built-in support for rate limiting, making it easier to secure your applications without relying on third-party libraries.

In this article, you'll learn what rate limiting is, why it matters, how to configure it in ASP.NET Core, and the best practices for using it in production.

What Is Rate Limiting?

Rate limiting is a technique that restricts the number of requests a client can send to an API during a defined time window.

For example, you might allow:

If the client exceeds the allowed limit, the API rejects additional requests until the limit resets.

This helps ensure fair usage and protects server resources.

Why Is Rate Limiting Important?

Implementing rate limiting provides several benefits:

These advantages make rate limiting an essential feature for public and enterprise APIs.

Adding Rate Limiting to an ASP.NET Core Application

ASP.NET Core provides built-in middleware for rate limiting.

First, register the required service.

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("fixed", limiterOptions =>
    {
        limiterOptions.PermitLimit = 100;
        limiterOptions.Window = TimeSpan.FromMinutes(1);
    });
});

In this example:

Enable the Middleware

After configuring the service, enable the middleware in the request pipeline.

var app = builder.Build();

app.UseRateLimiter();

This activates rate limiting for your application.

Applying Rate Limiting to an Endpoint

You can apply a specific rate-limiting policy to an API endpoint.

[EnableRateLimiting("fixed")]
[HttpGet]
public IActionResult GetProducts()
{
    return Ok(ProductRepository.GetAll());
}

The endpoint now follows the policy defined earlier, allowing only the configured number of requests within the specified time window.

Common Rate Limiting Strategies

ASP.NET Core supports different rate-limiting approaches depending on your application's needs.

Fixed Window

A fixed number of requests is allowed during a specific time period.

Example:

This approach is simple and works well for many APIs.

Sliding Window

Instead of resetting at fixed intervals, the request count moves continuously over time.

This provides smoother traffic control and reduces sudden spikes.

Token Bucket

Clients receive a certain number of tokens that are consumed with each request.

Tokens are replenished over time, allowing occasional traffic bursts while maintaining overall limits.

Concurrency Limiting

Instead of limiting requests over time, concurrency limiting controls how many requests can be processed simultaneously.

This is useful for protecting resource-intensive endpoints.

Practical Example

Imagine you're building an online ticket booking system.

Without rate limiting:

With rate limiting:

This creates a fair and reliable experience for everyone.

Handling Limit Exceeded Responses

When a client exceeds the configured limit, the API typically returns the HTTP 429 (Too Many Requests) status code.

Clients can use this response to determine that they should wait before sending additional requests.

Providing clear error messages and appropriate response headers helps client applications handle these situations gracefully.

Best Practices

When implementing rate limiting, consider the following recommendations:

Following these practices helps improve both security and user experience.

Common Use Cases

Rate limiting is commonly used in:

Any API exposed to external clients can benefit from rate limiting.

Things to Consider

While rate limiting improves security and stability, it should be configured carefully.

Keep the following points in mind:

A balanced approach helps protect your API without negatively impacting the user experience.

Conclusion

Rate limiting is a key part of building secure and scalable ASP.NET Core APIs. By controlling how many requests clients can make within a given time period, you can protect your application from abuse, reduce server load, and provide a more consistent experience for legitimate users.

ASP.NET Core's built-in rate-limiting middleware makes implementation straightforward while supporting multiple strategies, including fixed window, sliding window, token bucket, and concurrency limiting. By selecting the right policy, monitoring usage, and combining rate limiting with other security measures, you can build APIs that remain reliable and responsive even under heavy traffic.