Rate limiting restricts how many requests an ASP.NET Core application handles during a period or according to available capacity. It helps prevent heavy traffic from overwhelming the application, but rejected requests can surprise clients when capacity is exhausted. section 16.5
Configure rate limiting through the service collection and apply a named policy to endpoints or controllers.
- Set PermitLimit, QueueLimit, and the limiter-specific duration or capacity options; apply the named policy with RequireRateLimiting. section 16.5
One request every 15 seconds
Register a fixedWindow policy with PermitLimit = 1, QueueLimit = 0, and a 15-second Window, then enable rate-limiting middleware. Apply the policy to a controller with [EnableRateLimiting("fixedWindow")]. Add [DisableRateLimiting] to an action that must remain unrestricted. Reloading the limited collection endpoint produces a 503 after the first request, while the exempt detail endpoint remains available. section 19.5.7
