What is Rate Limiting?

Why is Rate Limiting?

Rate Limiting Algorithm

Fixed Window

Sliding Window

Token Bucket

Leaky Bucket

Sliding Log

Rate Limiting in .NET Core 7

ASP.NET Core has built support for Rate Limiter and has middleware for the same.

Step 1

Create a .NET Core 7 Web API Application.

Step 2

Create a new controller with different API endpoints as per requirement.

Step 3

Open the Program class and configure the fixed window rate limiter inside the same.

//Fixed Window Rate Litter Configuration
builder.Services.AddRateLimiter(_ => _
    .AddFixedWindowLimiter(policyName: "fixed", options =>
    {
        options.PermitLimit = 3;
        options.Window = TimeSpan.FromSeconds(10);
        options.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
        options.QueueLimit = 2;
    }));

Line 2: AddRateLimiter function to add rate limiting service inside service collection.

Line 3: AddFixedWindowLimiter to add a fixed window policy with a policy name fixed.

Line 5-6: PermitLimit 3 and Window have a 10-second timespan means 3 requests are allowed within a 10-second window timespan.

Line 7-8: QueueProcessingOrder is the OldestFirst, and QueueLimit is 2 means whenever the window limit is exceeded, in that case, subsequent two requests are throttled and stored inside the queue. When the window count is reset at that time requests are processed from the queue and the oldest request is picked for processing.

Step 4

Add UseRateLimiter middleware inside the program class to enable rate limiting in the request/response pipeline.

//Rate limitter middleware
app.UseRateLimiter();

Step 5

Inside the controller apply the rate limiter with the help of EnableRateLimiting attribute on any endpoint or controller level as per requirement.

If you want to disable the rate limiter on the particular endpoint that is possible using the DisableRateLimiting attribute.


using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.RateLimiting;
using RudderStackDemo.Entities;
using RudderStackDemo.Repositories;

namespace RudderStackDemo.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    [EnableRateLimiting("fixed")]
    public class ProductsController : ControllerBase
    {
        private readonly IProductService _productService;

        public ProductsController(IProductService productService)
        {
            _productService = productService;
        }

        /// <summary>
        /// Product List
        /// </summary>
        /// <returns></returns>
        [HttpGet]
        [EnableRateLimiting("fixed")]
        public async Task<IActionResult> ProductListAsync()
        {
            var productList = await _productService.ProductListAsync();
            if (productList != null)
            {
                return Ok(productList);
            }
            else
            {
                return NoContent();
            }
        }

        /// <summary>
        /// Get Product By Id
        /// </summary>
        /// <param name="productId"></param>
        /// <returns></returns>
        [HttpGet("{productId}")]
        [DisableRateLimiting]
        public async Task<IActionResult> GetProductDetailsByIdAsync(int productId)
        {
            var productDetails = await _productService.GetProductDetailByIdAsync(productId);
            if (productDetails != null)
            {
                return Ok(productDetails);
            }
            else
            {
                return NotFound();
            }
        }
    }
}

Step 6

Execute and Test API endpoints with the help of Swagger or Postman.

Github URL

https://github.com/Jaydeep-007/RateLimitDemo

Conclusion

In this article, we discuss what is rate limiters and the different algorithms related to them. After that, step-by-step implementation using .NET Core 7 and understanding the functionality of fixed window rate limiter.

Happy Coding!