0Pricing
C# Academy · Lesson

Rate Limiting Algorithms

Compare fixed, sliding, token, and concurrency limiters.

Rate Limiting Algorithms is a free C# Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the C# Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Rate Limit?

Rate limiting caps how many requests a client can make in a window of time. It protects your API from abuse, runaway clients and accidental traffic spikes, and keeps capacity fair across users.

// e.g. allow 100 requests per minute per API key

Built-in Rate Limiting

Since .NET 7, ASP.NET Core ships a first-class rate limiting middleware in Microsoft.AspNetCore.RateLimiting with four built-in algorithms.

// Algorithms: Fixed Window, Sliding Window,
//             Token Bucket, Concurrency

Fixed Window

The fixed window algorithm allows N requests per fixed time block. When the block ends, the counter resets to zero.

Simple, but bursts at a window boundary can briefly double the effective rate.

// 10 requests per 60s window
// All 10 used at 0:59, 10 more at 1:00 -> 20 in 2 seconds

Sliding Window

The sliding window smooths the boundary problem by dividing the window into segments and rolling expired segments forward, so the limit applies over any continuous window.

// 10 requests per 60s, 6 segments of 10s each
// The count slides as each segment expires

Token Bucket

The token bucket holds a bucket of tokens. Each request consumes one; tokens are refilled at a steady rate. It permits short bursts up to the bucket size while enforcing a long-run average.

// Bucket = 10 tokens, refill 5 tokens / 10s
// Burst of 10 allowed, then 5 every 10 seconds

Concurrency Limiter

The concurrency limiter is different: it caps the number of requests being processed at the same time, not per unit of time. Ideal for protecting expensive operations.

// At most 5 concurrent requests in flight
// The 6th waits in the queue or is rejected

The Queue

Each limiter can queue requests that exceed the limit instead of rejecting them immediately. QueueLimit sets the queue size and QueueProcessingOrder sets fairness (oldest or newest first).

// QueueLimit = 2, OldestFirst
// Over-limit requests wait if a slot exists, else get 503/429

Choosing an Algorithm

Match the algorithm to the goal:

  • Fixed window: simplest, good enough for many cases.
  • Sliding window: smoother, avoids boundary bursts.
  • Token bucket: allows controlled bursts.
  • Concurrency: limits simultaneous load, not rate.
// Bursty clients -> token bucket
// Expensive endpoint -> concurrency

Partitioning

Limits are applied per partition key - usually the user, API key or IP - so one noisy client cannot exhaust everyone's quota. A single shared partition would limit all traffic together.

// Partition by user id, IP, or API key
// Each partition gets its own independent counter

What the Client Sees

A rejected request returns HTTP 429 Too Many Requests. A well-behaved API also returns a Retry-After header telling the client when to try again.

// HTTP/1.1 429 Too Many Requests
// Retry-After: 30

Rate Limiting vs Throttling vs Quotas

Related ideas: rate limiting bounds short-term frequency, quotas bound longer-term totals (per day/month), and throttling slows rather than rejects. The middleware focuses on rate limiting.

// rate limit: 100/min   quota: 10000/day

Quick Check

Test your grasp of the algorithms.

Recap

You learned rate limiting concepts:

  • Four algorithms: fixed window, sliding window, token bucket, concurrency.
  • Token bucket allows bursts; concurrency caps simultaneous load.
  • Limits are applied per partition key; queues smooth overflow.
  • Rejected requests get 429 with Retry-After.

Next: configuring the middleware.

Frequently asked questions

Is the “Rate Limiting Algorithms” lesson free?

Yes — the full text of “Rate Limiting Algorithms” is free to read here on the web, and the C# Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the C# Academy course, upgrade to CoddyKit PRO.

What will I learn in “Rate Limiting Algorithms”?

Compare fixed, sliding, token, and concurrency limiters. You practise C# Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start C# Academy?

No prior experience is required. C# Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Rate Limiting Algorithms” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this C# Academy lesson?

Yes. Every C# Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Rate Limiting Algorithms
  2. Configuring Rate Limiting Middleware
  3. Output Caching Basics
  4. Cache Policies and Invalidation
← Back to C# Academy