Asp.Net Web Api Rate Limiting And Throttling Complete Guide

In this step-by-step guide, we will create a simple ASP.NET Web API project and implement rate limiting and throttling using the AspNetCoreRateLimit package, which is very popular for these purposes in .NET Core applications.

Step 1: Create an ASP.NET Web API Project

First, ensure you have Visual Studio installed. Open Visual Studio and follow these steps:

1. Go to File > New > Project.
2. Select ASP.NET Core Web API from the list of templates.
3. Name your project, e.g., RateLimitingApi.
4. Click Create.

Step 2: Install AspNetCoreRateLimit Package

The AspNetCoreRateLimit package provides both rate limiting and throttling features. To install it, open the NuGet Package Manager Console and run the following command:

Install-Package AspNetCoreRateLimit

Alternatively, you can use the NuGet Package Manager UI or the .NET CLI to add the package:

Using .NET CLI:

dotnet add package AspNetCoreRateLimit

Step 3: Configure Services in Startup.cs

For projects created using .NET 6 and later, there is a single Program.cs file where you configure services. For older versions of ASP.NET Core (e.g., .NET 5, .NET Core 3.1), you would configure services in the Startup.cs file. Here, I'm showing the setup for both versions.

For .NET 6 and Later (Program.cs)

Open the Program.cs file in your project and add the necessary code to configure rate limiting and throttling:

using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using AspNetCoreRateLimit;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddControllers();

// Register rate limiting services
builder.Services.AddMemoryCache();
builder.Services.Configure<IpRateLimitOptions>(builder.Configuration.GetSection("IpRateLimiting"));
builder.Services.AddSingleton<IRateLimitConfiguration, RateLimitConfiguration>();
builder.Services.Configure<RouteRateLimitOptions>(builder.Configuration.GetSection("RouteRateLimiting"));

// Register the middleware
builder.Services.AddSingleton<IIpPolicyStore, MemoryCacheIpPolicyStore>();
builder.Services.AddSingleton<IIpRateLimitCounterStore, MemoryCacheRateLimitCounterStore>();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}

app.UseHttpsRedirection();
app.UseAuthorization();

// Add rate limiting middleware
app.UseIpRateLimiting();

app.MapControllers();

app.Run();

For .NET 5 and Earlier (Startup.cs)

If you are using the Startup.cs pattern, modify the ConfigureServices and Configure methods as follows:

public class Startup
{
    public IConfiguration Configuration { get; }

    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllers();

        // Register rate limiting services
        services.AddMemoryCache();
        services.Configure<IpRateLimitOptions>(Configuration.GetSection("IpRateLimiting"));
        services.AddSingleton<IRateLimitConfiguration, RateLimitConfiguration>();
        services.Configure<RouteRateLimitOptions>(Configuration.GetSection("RouteRateLimiting"));

        // Register the middleware
        services.AddSingleton<IIpPolicyStore, MemoryCacheIpPolicyStore>();
        services.AddSingleton<IIpRateLimitCounterStore, MemoryCacheRateLimitCounterStore>();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        app.UseHttpsRedirection();
        app.UseRouting();
        app.UseCors();
        app.UseAuthorization();

        // Add rate limiting middleware
        app.UseIpRateLimiting(); 
        app.UseMiddleware<EnableRateLimiting>(); 

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
}

Step 4: Add Configuration to appsettings.json

To configure rate limiting and throttling policies, you need to add them to the appsettings.json file:

{
  "IpRateLimiting": {
    "EnableEndpointRateLimiting": true,
    "StackBlockedRequests": false,
    "RealIpHeader": "X-Real-IP",
    "ClientIdHeader": "X-ClientId",
    "HttpStatusCode": 429,
    "GeneralRules": [
      {
        "Endpoint": "*",
        "Period": "1m",
        "Limit": 10
      }
    ]
  },
  "RouteRateLimiting": {
    "EnableRateLimiting": true,
    "AreaName": null,
    "ActionName": null,
    "ControllerName": null,
    "RealIpHeader": "x-real-ip",
    "ClientIdHeader": "x-clientid",
    "HttpStatusCode": 429,
    "DefaultRule": null,
    "IPLimitDefinitions": {
      "Anonymous": {
        "Endpoint": "*",
        "Period": "1m",
        "Limit": 5
      }
    },
    "ClientRateLimitRules": [
      {
        "Id": "ClientId_D",
        "ClientId": "D",
        "HttpMethods": ["get"],
        "Endpoint": "/api/values*",
        "Period": "1m",
        "Limit": 10
      }
    ]
  }
}

Explanation of Configuration:

1. IpRateLimiting:

   • EnableEndpointRateLimiting: Enables endpoint-specific rate limiting.
   • StackBlockedRequests: Whether to stack blocked requests or not.
   • RealIpHeader and ClientIdHeader: Custom headers for IP and ClientID if needed.
   • HttpStatusCode: The HTTP status code to return when a limit is exceeded.
   • GeneralRules: Rules that apply to all endpoints unless overridden. Here, we set a limit of 10 requests per minute for all endpoints.

2. RouteRateLimiting:

   • EnableRateLimiting: Enables route-based rate limiting.
   • IPLimitDefinitions: Defines rules based on IP address. In this example, anonymous users have a limit of 5 requests per minute.
   • ClientRateLimitRules: Defines rules based on Client ID and HTTP method. Here, Client ID D has a limit of 10 Get requests per minute to the /api/values endpoint.

Step 5: Create a Sample Controller

Create a sample controller to test the rate limiting features. You can scaffold a new controller using the menu in Visual Studio or add it manually. Here’s an example of how to create a simple ValuesController:

using Microsoft.AspNetCore.Mvc;

namespace RateLimitingApi.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class ValuesController : ControllerBase
    {
        [HttpGet]
        public IActionResult Get()
        {
            return Ok(new[] { "value1", "value2" });
        }

        [HttpGet("{id}")]
        public IActionResult Get(int id)
        {
            return Ok("value");
        }

        [HttpPost]
        public IActionResult Post([FromBody] string value)
        {
            return CreatedAtAction(nameof(Get), new { id = 1 }, value);
        }

        [HttpPut("{id}")]
        public IActionResult Put(int id, [FromBody] string value)
        {
            return NoContent();
        }

        [HttpDelete("{id}")]
        public IActionResult Delete(int id)
        {
            return NoContent();
        }
    }
}

Step 6: Test Your API

Run your application and try sending multiple requests to the API endpoints. You can use tools such as Postman or a browser to test the API.

Example Endpoint:

• GET /api/values
• GET /api/values/1

If you exceed the per-minute limit defined in your configuration (10 requests for GET /api/values and 5 requests for anonymous users), you should receive a response with HTTP status code 429 (Too Many Requests).

Step 7: Optional - Client-Specific Rate Limiting

You can also enforce rate limits based on client-specific IDs. For example, to test the client-specific rule:

1. Set the X-ClientId header to D when making requests to /api/values.
2. Check that the rate limit is correctly enforced at 10 requests per minute.

You can achieve this with Postman by setting custom headers in the Headers tab before sending the request.

Conclusion

In this step-by-step guide, we created a simple ASP.NET Web API project and implemented rate limiting and throttling using the AspNetCoreRateLimit library. We configured these features via the appsettings.json file and tested the limits to ensure they were being enforced correctly. This setup helps prevent abuse and ensures fair usage of your API resources.