How do you apply the built-in Rate Limiting Middleware in .NET 7+?

Short answer

Call builder.Services.AddRateLimiter, configure algorithms such as FixedWindow, SlidingWindow, or TokenBucket, and apply them with [EnableRateLimiting].

Explanation

.NET added powerful built-in request-rate limiting without requiring a third-party library. It supports several algorithms: Fixed Window for a fixed window, Sliding Window to prevent bursts at the edge of a minute, Token Bucket to allow bursts of requests, and Concurrency Limiter to cap simultaneous open connections.

Code example

builder.Services.AddRateLimiter(options => {
    options.AddFixedWindowLimiter("fixed", opt => {
        opt.PermitLimit = 100;
        opt.Window = TimeSpan.FromMinutes(1);
    });
});
app.UseRateLimiter();

Common mistakes

• Not configuring OnRejected to return structured JSON and a clear Retry-After header when rejecting a client with status 429.

Follow-up questions

• How does Output Caching in .NET 7+ improve on the older Response Caching Middleware?

Sources

• Microsoft Learn — Rate limiting middleware in ASP.NET Core