ASP.Net Core RateLimiting Sample

program.cs

using Microsoft.AspNetCore.RateLimiting;
using System.Net;
using System.Threading.RateLimiting;

var builder = WebApplication.CreateBuilder(args);

var app = builder.Build();

var options = new RateLimiterOptions()
    .AddPolicy<string>("user", context =>
    {
        if (context.User?.Identity?.IsAuthenticated ?? false)
        {
            var username = context.User.FindFirst("username").Value;
            
            return RateLimitPartition.CreateSlidingWindowLimiter<string>(username, key => new SlidingWindowRateLimiterOptions(
                permitLimit: 2,
                queueProcessingOrder: QueueProcessingOrder.OldestFirst,
                queueLimit: 0,
                window: TimeSpan.FromSeconds(30),
                segmentsPerWindow: 1
                ));
        }
        else
        {
            return RateLimitPartition.CreateNoLimiter<string>(string.Empty);
        }
    });
                    
options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, IPAddress>(context =>
{
    if (!IPAddress.IsLoopback(context.Connection.RemoteIpAddress))
    {
        return RateLimitPartition.CreateSlidingWindowLimiter<IPAddress>(context.Connection.RemoteIpAddress, key => new SlidingWindowRateLimiterOptions(
            permitLimit: 10,
            queueProcessingOrder: QueueProcessingOrder.OldestFirst,
            queueLimit: 0,
            window: TimeSpan.FromSeconds(30),
            segmentsPerWindow: 1
            ));
    }
    else
    {
        return RateLimitPartition.CreateNoLimiter<IPAddress>(IPAddress.Loopback);
    }
});

app.UseRateLimiter(options);

app.MapGet("/", () => "Hello World!");
app.MapGet("/api/a", () => "Hello A!").RequireRateLimiting("user");
app.MapGet("/api/b", () => "Hello B!").RequireRateLimiting("user");

app.Run();