ASP.NET Core Interview Question #196

What is rate limiting in ASP.NET Core?

Performance, Caching & HTTP Senior Advanced

Quick Interview Answer

Rate limiting restricts how frequently clients can access selected endpoints. It can protect application capacity, reduce abuse, and provide fairer resource usage.

Detailed Explanation

Rate limiting restricts how frequently clients can access selected endpoints. It can protect application capacity, reduce abuse, and provide fairer resource usage.

ASP.NET Core includes rate-limiting middleware with strategies such as fixed window, sliding window, token bucket, and concurrency limiting. Policies can be applied to endpoints and can partition limits by an appropriate key.

Rate limiting is one layer of protection and should complement authentication, authorization, infrastructure controls, and monitoring.

Code Example

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("api", opt =>
    {
        opt.PermitLimit = 100;
        opt.Window = TimeSpan.FromMinutes(1);
    });
});

var app = builder.Build();
app.UseRateLimiter();

app.MapGet("/api/data", () => Results.Ok())
   .RequireRateLimiting("api");