Rate Limiting API

A .NET 8 Web API project that implements rate limiting functionality using Redis as a distributed cache. This API demonstrates how to protect endpoints from abuse by limiting the number of requests per client within a specified time window.

Features

• Rate Limiting: Configurable rate limiting with Redis-based storage
• IP-based Client Identification: Automatically identifies clients by their IP address
• Distributed Rate Limiting: Uses Redis for scalable, distributed rate limiting across multiple server instances
• HTTP 429 Response: Returns proper HTTP status codes when rate limits are exceeded
• Configurable Limits: Easy to configure request limits and time windows

Technology Stack

• .NET 8: Latest LTS version of .NET
• ASP.NET Core: Web framework for building HTTP APIs
• Redis: Distributed cache for storing rate limiting data
• StackExchange.Redis: High-performance Redis client for .NET

Prerequisites

• .NET 8 SDK
• Redis server (local or remote)

Getting Started

1. Clone the Repository

git clone <repository-url>
cd RateLimitingApi

2. Configure Redis Connection

Update the Redis connection string in appsettings.json:

{
  "ConnectionStrings": {
    "Redis": "localhost:6379"
  }
}

For production environments, replace localhost:6379 with your Redis server address.

3. Run the Application

dotnet run

The API will be available at https://localhost:5001 or http://localhost:5000.

API Endpoints

Sample Endpoint

• GET /sample/hello
  • Returns a simple "Hello, World!" message
  • Protected by rate limiting middleware

Rate Limiting Configuration

The rate limiting is configured with the following default settings:

• Request Limit: 100 requests per client
• Time Window: 1 minute
• Client Identification: Based on IP address

These settings can be modified in the RateLimitingService.cs file:

private readonly int _limit = 100;
private readonly TimeSpan _timeWindow = TimeSpan.FromMinutes(1);

How It Works

1. Request Interception: The RateLimitingMiddleware intercepts all incoming requests
2. Client Identification: Each client is identified by their IP address
3. Redis Storage: Request counts are stored in Redis with automatic expiration
4. Limit Checking: Before processing each request, the system checks if the client has exceeded their limit
5. Response: If the limit is exceeded, a 429 (Too Many Requests) status is returned

Project Structure

RateLimitingApi/
├── Controllers/
│   └── SampleController.cs          # Example API controller
├── Middleware/
│   └── RateLimitingMiddleware.cs    # Rate limiting middleware
├── Services/
│   └── RateLimitingService.cs       # Core rate limiting logic
├── Program.cs                       # Application entry point
├── appsettings.json                 # Configuration file
└── RateLimitingApi.csproj          # Project file

Testing the Rate Limiting

You can test the rate limiting functionality using curl or any HTTP client:

# Make multiple requests quickly
for i in {1..110}; do
  curl -i http://localhost:5000/sample/hello
  echo "Request $i"
done

After 100 requests within a minute, you should receive a 429 status code.

Customization

Adding Rate Limiting to New Controllers

The rate limiting middleware is applied globally to all endpoints. To exclude specific endpoints, you can modify the middleware to check the request path:

// In RateLimitingMiddleware.cs
if (context.Request.Path.StartsWithSegments("/health"))
{
    await _next(context);
    return;
}

Different Rate Limits for Different Endpoints

To implement different rate limits for different endpoints, you can extend the RateLimitingService to accept endpoint-specific configurations.

Production Considerations

1. Redis Configuration: Use a production Redis instance with proper authentication and SSL
2. Monitoring: Implement logging and monitoring for rate limiting events
3. Whitelisting: Consider implementing IP whitelisting for trusted clients
4. Rate Limit Headers: Add rate limit headers to responses (X-RateLimit-*)
5. Configuration: Move rate limiting settings to configuration files

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests if applicable
5. Submit a pull request

License

This project is licensed under the MIT License - see the LICENSE file for details.