ASP.NET Core RateLimit with ActionFilters and EndPointFilters

When building web applications, you might often want to control the frequency of user requests to prevent malicious attacks. In other words, you might want to limit the number of requests coming from an IP address during a short timespan to mitigate denial-of-service attacks. This process is known as rate limiting.

There are many Nuget packages that use Middleware for handling user requests but there is a problem with middleware because they affect all incoming requests! So, what is the solution if you want to control just some critical endpoints? Yes, that is ActionFilters (or EndPointFilters)!

Let’s go to find out how to use action filters as a rate limit.

Create Asp.net core API project:

1- Click on “Create new project”
2- Select Asp.net core web api

3- Enter the project name

4- Select target framework (I selected .net6.0 but you select any LTS version that installed in your system)

Ok you created the project, now you should install this Nuget package:

Install-Package DotNetRateLimiter

And add this line to your Program.cs

builder.Services.AddRateLimitService(builder.Configuration);

Now you use the rate limit on your Action methods:

[HttpGet]
[RateLimit(PeriodInSec = 60, Limit = 3)]
public IEnumerable<WeatherForecast> Get()
{
    return Enumerable.Range(1, 5).Select(index => new WeatherForecast
    {
        Date = DateTime.Now.AddDays(index),
        TemperatureC = Random.Shared.Next(-20, 55),
        Summary = Summaries[Random.Shared.Next(Summaries.Length)]
    })
    .ToArray();
}

In this way the action only allows 3 requests per minute let’s test it in swagger. if you try to call api more than 3 times it gets 429 (Too Many requests):

Nice! it works.
So, if you want to restrict the action method with parameters even in route or query string or request body (Really!), it could be possible like:

[HttpGet("forecast/{id1}/{id2}")]
[RateLimit(PeriodInSec = 60, Limit = 3, RouteParams = "id1,id2", QueryParams = "name1,name2")]
public IEnumerable<WeatherForecast> Get(int id1, string id2, string name1, string name2)
{
    return Enumerable.Range(1, 5).Select(index => new WeatherForecast
    {
        Date = DateTime.Now.AddDays(index),
        TemperatureC = Random.Shared.Next(-20, 55),
        Summary = Summaries[Random.Shared.Next(Summaries.Length)]
    })
        .ToArray();
}

You can customize the rate limit response if needed, for the sake of this you need to add config into appsettings.json file:

As you noticed there are some options that can be useful, the RateLimit uses InMemory cache by default, but if you set up a Redis connection it will use Redis, it is recommended that we use Redis to check the rate limit in distributed applications. By default, it limits the IP address for control requests but you can set ClientIdentifier in the request headers and the header name is configurable.

Supporting

Please support us by giving a star ⭐ to the project repository on GitHub if this helped you.