ASP.NET Core Interview Question #246

How would you protect an API from abusive or unexpectedly expensive clients?

Senior ASP.NET Core Real-World Scenarios Senior Advanced

Quick Interview Answer

Require authentication where appropriate and apply authorization to sensitive operations. Add rate limiting or concurrency limiting based on a meaningful partition such as client identity, API key, tenant, or endpoint.

Detailed Explanation

Require authentication where appropriate and apply authorization to sensitive operations. Add rate limiting or concurrency limiting based on a meaningful partition such as client identity, API key, tenant, or endpoint.

Set request body and upload limits, validate pagination bounds, use timeouts, and prevent clients from requesting unbounded data or computationally expensive queries. Monitor rejection rates and resource usage so policies can be tuned.

Infrastructure protections such as a gateway, WAF, or DDoS service can complement application-level controls.

Code Example

app.MapGet("/api/search", Search)
   .RequireAuthorization()
   .RequireRateLimiting("search");

// Also validate page size and query complexity
// inside the endpoint/application service.