Rate Limiting in .NET: Everything You Need to Know

4 min readMar 19, 2023

Rate limiting is an essential technique for preventing abuse and controlling the rate of requests made to an API or web application. It is used to ensure that the server can handle the number of requests being made and to prevent excessive consumption of resources. In this blog post, we will discuss everything you need to know about rate limiting in .NET, including its advantages, disadvantages, how it works, and how to use it with code snippets.

Advantages of Rate Limiting in .NET:

Prevents excessive resource consumption: Rate limiting ensures that the number of requests being made to a server is within acceptable limits, preventing excessive resource consumption that could lead to performance degradation or system failure.

Protects against attacks: Rate limiting can be used to prevent malicious actors from launching attacks such as DDoS or brute-force attacks by limiting the number of requests they can make within a given time period.

Ensures fair use: Rate limiting can be used to ensure that all users have equal access to resources, preventing any one user from monopolizing server resources or services.

Disadvantages of Rate Limiting in .NET:

Reduced performance: Rate limiting can potentially reduce the performance of an application or API by introducing additional processing overhead and delaying responses to legitimate requests.

Complexity: Implementing rate limiting can be a complex task, especially for applications with high traffic volumes or complex user access patterns.

False positives: Rate limiting can result in false positives, where legitimate users are mistakenly blocked due to exceeding the limit, leading to a negative user experience.

How Rate Limiting Works in .NET:

Rate limiting involves controlling the rate at which requests are made to a server or API. This is done by monitoring the number of requests made within a specific time frame and enforcing limits on the number of requests that can be made within that time frame. There are different types of rate limiting techniques, including:

Token Bucket: Token Bucket is a rate-limiting algorithm that allows bursts of requests up to a certain size, followed by a slower rate of requests. Tokens are added to the bucket at a certain rate and removed as requests are made.

Leaky Bucket: Leaky Bucket is a rate-limiting algorithm that regulates the rate of requests by holding them in a buffer and releasing them at a fixed rate. If the buffer overflows, excess requests are dropped.

Fixed Window: Fixed Window is a rate-limiting algorithm that divides time into fixed windows and allows a fixed number of requests within each window.

How Rate Limiting Works:

Rate limiting works by setting limits on the number of requests that can be sent or received within a specific time period. When a user or application sends a request, the system checks to see if the limit has been reached. If the limit has been reached, the request is either delayed or denied.

Implementing Rate Limiting in C#/.NET:

There are several ways to implement rate limiting in C#/.NET, including using a third-party library or implementing it manually. Here’s an example of how to implement rate limiting using a custom middleware in ASP.NET Core:

Create a new ASP.NET Core project in Visual Studio.
Add a new class called “RateLimitMiddleware” with the following code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Caching.Memory;

namespace RateLimitingDemo
{
    public class RateLimitMiddleware
    {
        private readonly RequestDelegate _next;
        private readonly IMemoryCache _cache;

        public RateLimitMiddleware(RequestDelegate next, IMemoryCache cache)
        {
            _next = next;
            _cache = cache;
        }

        public async Task Invoke(HttpContext context)
        {
            var ipAddress = context.Connection.RemoteIpAddress.ToString();

            var cacheKey = $"{ipAddress}";

            if (!_cache.TryGetValue(cacheKey, out int requestCount))
            {
                requestCount = 0;
            }

            requestCount++;

            var cacheEntryOptions = new MemoryCacheEntryOptions()
                .SetAbsoluteExpiration(TimeSpan.FromSeconds(10));

            _cache.Set(cacheKey, requestCount, cacheEntryOptions);

            if (requestCount > 5)
            {
                context.Response.StatusCode = 429; // Too Many Requests
                await context.Response.WriteAsync("Rate limit exceeded.");
                return;
            }

            await _next(context);
        }
    }
}

Modify the “Configure” method in the “Startup.cs” file to use the new middleware:

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseMiddleware<RateLimitMiddleware>();
    app.UseMvc();
}

This middleware sets a limit of five requests per ten seconds

In conclusion, rate limiting is an important technique for controlling the usage of APIs, preventing abuse, and ensuring the best user experience for all. In this blog post, we have discussed the advantages and disadvantages of rate limiting, how it works, and how to implement it in C#/.NET.

There are many libraries and frameworks available for rate limiting in C#, including Polly, AspNetCoreRateLimit, and EasyThrottle. These tools provide a flexible and powerful way to limit API calls based on various parameters and configurations.

Overall, rate limiting is a crucial aspect of API design and development, and every developer should understand how to implement it effectively. By using rate limiting, you can ensure the stability and security of your API, prevent unwanted traffic, and improve the user experience for your customers.

Rate Limiting in .NET: Everything You Need to Know

Written by Abhinn Mishra