How does rate limiting work in ASP.NET Core?
Quick Answer
The built-in rate limiter (.NET 7+) is middleware — AddRateLimiter + UseRateLimiter — with four algorithms: fixed window, sliding window, token bucket, and concurrency. You partition by a key (IP, API key, user id) so limits apply per caller, and rejected requests get 429 Too Many Requests.
Since .NET 7 there's a rate-limiting middleware. You register a policy with one of four algorithms — fixed window, sliding window, token bucket for allowing bursts, or concurrency which caps simultaneous requests. You partition by a key like the client IP or API key so the limit is per caller, and when someone exceeds it they get a 429 with a Retry-After. The thing to be careful about is that with multiple app instances, each has its own limiter, so it's not a true global cap — for that you'd back it with Redis or do the limiting at the API gateway.
- Fixed window — N requests per interval; simple but bursty at window edges.
- Sliding window — smooths the edges by dividing the window into segments.
- Token bucket — tokens refill at a steady rate; allows short bursts up to the bucket size.
- Concurrency — caps simultaneous in-flight requests (a bulkhead), not a rate.
- Apply globally, or per-endpoint with
[EnableRateLimiting("policy")]. Configure the rejection response (429 +Retry-After). - For multi-instance apps, a per-instance limiter isn't a true global limit — use a distributed store (Redis) or enforce at the gateway.