Built-in Rate Limiting Middleware (`System.Threading.RateLimiting`)

1Concept

.NET 8/9 includes native Rate Limiting algorithms: Fixed Window, Sliding Window, Token Bucket, and Concurrency Limiters to protect APIs against DDoS and noisy neighbor abuse.

2Architecture Diagram

Incoming Client Requests
       │
[ Token Bucket Rate Limiter (Capacity: 100, Refill: 10/sec) ]
  ├── Tokens Available? ──> Consume Token & Allow Request
  └── Bucket Empty?     ──> Return 429 Too Many Requests with Retry-After Header

3Code Example

using System;
using System.Threading.RateLimiting;

public class RateLimitingConceptDemo
{
    public static void Main()
    {
        Console.WriteLine("Rate Limiting Algorithms supported in ASP.NET Core 9:");
        Console.WriteLine("1. FixedWindowLimiter");
        Console.WriteLine("2. SlidingWindowLimiter");
        Console.WriteLine("3. TokenBucketRateLimiter");
        Console.WriteLine("4. ConcurrencyLimiter");
    }
}

4Expected Output

Rate Limiting Algorithms supported in ASP.NET Core 9:
1. FixedWindowLimiter
2. SlidingWindowLimiter
3. TokenBucketRateLimiter
4. ConcurrencyLimiter

5Key Takeaways

• ✓Apply globally or on specific endpoint groups (`.RequireRateLimiting("fixed")`).
• ✓Partition limits by Client IP or Authenticated User ID.
• ✓Returns standard `429 Too Many Requests` HTTP status.