Configuring Rate Limiting Middleware
Apply rate limits per endpoint and policy.
Configuring Rate Limiting Middleware is a free C# Academy lesson on CoddyKit. This is lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the C# Academy learning path, and your progress syncs across the web and the CoddyKit app. The C# Academy course includes 4 lessons in total.
AddRateLimiter
Configuration starts with AddRateLimiter in the service container. You define one or more named policies and an optional global rejection status code.
builder.Services.AddRateLimiter(options =>
{
options.RejectionStatusCode =
StatusCodes.Status429TooManyRequests;
});A Fixed Window Policy
AddFixedWindowLimiter registers a named policy. Set the permit limit, window length and queue behavior.
options.AddFixedWindowLimiter("fixed", limiter =>
{
limiter.PermitLimit = 100;
limiter.Window = TimeSpan.FromMinutes(1);
limiter.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
limiter.QueueLimit = 0;
});A Sliding Window Policy
AddSlidingWindowLimiter adds SegmentsPerWindow to control smoothing granularity.
options.AddSlidingWindowLimiter("sliding", limiter =>
{
limiter.PermitLimit = 100;
limiter.Window = TimeSpan.FromMinutes(1);
limiter.SegmentsPerWindow = 6;
limiter.QueueLimit = 0;
});A Token Bucket Policy
AddTokenBucketLimiter sets the bucket size and the replenishment rate.
options.AddTokenBucketLimiter("token", limiter =>
{
limiter.TokenLimit = 100;
limiter.TokensPerPeriod = 20;
limiter.ReplenishmentPeriod = TimeSpan.FromSeconds(10);
limiter.QueueLimit = 0;
});A Concurrency Policy
AddConcurrencyLimiter caps simultaneous requests.
options.AddConcurrencyLimiter("concurrent", limiter =>
{
limiter.PermitLimit = 5;
limiter.QueueLimit = 10;
limiter.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
});Adding the Middleware
Activate rate limiting in the pipeline with UseRateLimiter. Place it early, after routing.
var app = builder.Build();
app.UseRateLimiter();
app.MapControllers();RequireRateLimiting
Apply a named policy to endpoints with RequireRateLimiting (minimal API) or the [EnableRateLimiting] attribute (controllers).
app.MapGet("/search", () => Results.Ok())
.RequireRateLimiting("token");
// Controller equivalent:
// [EnableRateLimiting("token")]Disabling on Specific Endpoints
Exempt an endpoint from a group or global limiter with DisableRateLimiting or [DisableRateLimiting].
app.MapGet("/health", () => Results.Ok())
.DisableRateLimiting();A Global Limiter with Partitions
GlobalLimiter applies to every request. Use PartitionedRateLimiter.Create to give each user or IP its own counter.
options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>(
context =>
{
var key = context.User.Identity?.Name
?? context.Connection.RemoteIpAddress?.ToString()
?? "anon";
return RateLimitPartition.GetFixedWindowLimiter(key, _ =>
new FixedWindowRateLimiterOptions
{
PermitLimit = 100,
Window = TimeSpan.FromMinutes(1)
});
});Customizing the Rejection
OnRejected lets you add a Retry-After header or a friendly body when a request is throttled.
options.OnRejected = async (context, token) =>
{
if (context.Lease.TryGetMetadata(
MetadataName.RetryAfter, out var retry))
context.HttpContext.Response.Headers.RetryAfter =
((int)retry.TotalSeconds).ToString();
await context.HttpContext.Response
.WriteAsync("Rate limit exceeded.", token);
};Applying to a Route Group
Attach a policy to a whole route group so every endpoint inside shares the limit.
var api = app.MapGroup("/api")
.RequireRateLimiting("fixed");
api.MapGet("/products", () => Results.Ok());
api.MapGet("/orders", () => Results.Ok());Quick Check
Confirm the middleware setup.
Recap
You configured rate limiting:
AddRateLimiterdefines fixed window, sliding window, token bucket and concurrency policies.UseRateLimiteractivates the middleware;RequireRateLimitingapplies a policy.GlobalLimiterwithPartitionedRateLimitergives per-client counters.OnRejectedcustomizes the 429 response.
Next: output caching.
Learn C# with an AI tutor — free
Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.
- Courses
- 93
- Lessons
- 346
Frequently Asked Questions
Is the “Configuring Rate Limiting Middleware” lesson free?
Yes — the full text of “Configuring Rate Limiting Middleware” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the C# Academy course, upgrade to CoddyKit PRO. The C# Academy course includes 4 lessons in total.
What will I learn in “Configuring Rate Limiting Middleware”?
Apply rate limits per endpoint and policy. You practise C# Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start C# Academy?
No prior experience is required. C# Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 2 of 4.
How long does the “Configuring Rate Limiting Middleware” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this C# Academy lesson?
Yes. Every C# Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Rate Limiting Algorithms
- Configuring Rate Limiting Middleware
- Output Caching Basics
- Cache Policies and Invalidation