ASP.NET Core Web API Interview Question #197

How should rate limiting work behind a reverse proxy or load balancer?

Senior API Design, Architecture, Scalability & Production Scenarios Senior Advanced

Quick Interview Answer

Choose the rate-limit partition using trusted identity information such as an authenticated client, API key, or correctly processed forwarded address. Do not blindly trust arbitrary forwarding headers supplied directly by the internet.

Detailed Explanation

Choose the rate-limit partition using trusted identity information such as an authenticated client, API key, or correctly processed forwarded address. Do not blindly trust arbitrary forwarding headers supplied directly by the internet.

In a multi-instance deployment, purely in-process counters may not enforce a single global quota. Decide whether limits are per instance, enforced at an API gateway, or coordinated through shared infrastructure.

Code Example

// Prefer a stable authenticated partition when possible:
var clientId = httpContext.User.FindFirstValue("client_id");

// Gateway-level rate limiting may be appropriate
// for global quotas across many API instances.