Design a rate-limiting strategy for login, search, and authenticated write endpoints in ASP.NET Core.

Rate-limit by a meaningful server-derived partition such as authenticated account, tenant, API key, and sometimes IP. Fixed windows are simple; token buckets allow controlled bursts; concurrency limits protect expensive operations. Example: builder.Services.AddRateLimiter(options => options.AddTokenBucketLimiter("writes", o => { o.TokenLimit = 20; o.TokensPerPeriod = 10; o.ReplenishmentPeriod = TimeSpan.FromSeconds(10); o.QueueLimit = 0; o.AutoReplenishment = true; })); Return 429 with Retry-After, apply stricter limits to login/password reset, and coordinate state across instances when required. Do not trust spoofable headers unless a trusted proxy rewrites them. Monitor rejects and combine throttling with authentication, quotas, input bounds, and upstream protection.

Backbencher Developer · 2026-09-26 · 0 likes