ASP.NET Core Minimal API Rate Limit

In this tutorial, you'll learn about ASP.NET Core Minimal API Rate Limit. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Your API endpoint is hammered by a client. No Rate Limiting means one user can consume all resources and degrade the experience for others.

Wrong

csharp

app.MapGet("/api/search", (string query) =>
{
    return Results.Ok(Search(query));
});
// No rate limit — unlimited requests

Right

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("SearchPolicy", opt =>
    {
        opt.PermitLimit = 10;
        opt.Window = TimeSpan.FromSeconds(1);
        opt.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
        opt.QueueLimit = 2;
    });
});

var app = builder.Build();
app.UseRateLimiter();

app.MapGet("/api/search", (string query) =>
{
    return Results.Ok(Search(query));
}).RequireRateLimiting("SearchPolicy");

Prevention

• Use AddRateLimiter with FixedWindowLimiter, SlidingWindowLimiter, or TokenBucketLimiter.
• Apply RequireRateLimiting on endpoints or groups.
• Use DisableRateLimiting on public/limited endpoints.
• Return custom rate limit headers via the OnRejected callback.
• Test Rate Limiting behavior with load testing.

Common Mistakes with core minimal rate limit

1. Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks
2. Using return to exit a function early instead of wrapping a pure value in the monad
3. Mixing let bindings with <- bindings in do notation, producing type errors

These mistakes appear frequently in real-world ASPNET code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

What Rate Limiting strategies are available?

Learn more at DodaTech.