Rate Limiting

using System.Threading.RateLimiting;
using Microsoft.AspNetCore.HttpOverrides;

var builder = WebApplication.CreateBuilder(args);
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    options.KnownIPNetworks.Add(System.Net.IPNetwork.Parse("10.244.0.0/16"));
});
builder.Services.AddHealthChecks();

builder.Services.AddRateLimiter(options =>
{
    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;

    var perClientIp = PartitionedRateLimiter.Create<HttpContext, string>(context =>
        RateLimitPartition.GetSlidingWindowLimiter(
            context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
            _ => new SlidingWindowRateLimiterOptions
            {
                PermitLimit = 600,
                Window = TimeSpan.FromMinutes(1),
                SegmentsPerWindow = 6
            }));

    // Protects the instance as a whole: never more than 200 requests in flight.
    var wholeInstance = PartitionedRateLimiter.Create<HttpContext, string>(_ =>
        RateLimitPartition.GetConcurrencyLimiter("instance",
            _ => new ConcurrencyLimiterOptions { PermitLimit = 200, QueueLimit = 0 }));

    options.GlobalLimiter = PartitionedRateLimiter.CreateChained(perClientIp, wholeInstance);
});

var app = builder.Build();
app.UseForwardedHeaders(); // RemoteIpAddress must be the client, not the ingress
app.UseRateLimiter();

// Skips the whole GlobalLimiter chain, not just one limiter in it.
app.MapHealthChecks("/healthz").DisableRateLimiting();
app.MapGet("/products", () => TypedResults.Ok(new[] { new { id = 1, name = "Grinder" } }));

app.Run();

using System.Security.Claims;
using System.Threading.RateLimiting;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.RateLimiting;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllers();
builder.Services.AddAuthentication().AddJwtBearer(options => options.MapInboundClaims = false);
builder.Services.AddAuthorization();

builder.Services.AddRateLimiter(options =>
{
    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
    options.AddPolicy("per-user", context =>
    {
        // Runs after UseAuthentication, so User is the validated token's subject.
        // With MapInboundClaims = false the id stays "sub"; NameIdentifier would be null (see claims transformation).
        var userId = context.User.FindFirstValue("sub") ?? "anonymous";
        return RateLimitPartition.GetTokenBucketLimiter(userId, _ => new TokenBucketRateLimiterOptions
        {
            TokenLimit = 20,                                 // burst size
            TokensPerPeriod = 5,
            ReplenishmentPeriod = TimeSpan.FromSeconds(1),  // 5 per second sustained
            QueueLimit = 0
        });
    });
});

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.UseRateLimiter();
app.MapControllers();
app.Run();

[ApiController]
[Route("api/invoices")]
[Authorize]
[EnableRateLimiting("per-user")]
public class InvoicesController : ControllerBase
{
    [HttpGet]
    public IActionResult List() => Ok(new[] { new { number = "INV-2026-0042", total = 980.00m } });

    // Downloading an already generated PDF is cheap; exclude it from the user's bucket.
    [HttpGet("{number}/pdf")]
    [DisableRateLimiting]
    public IActionResult Pdf(string number) => File(Array.Empty<byte>(), "application/pdf", $"{number}.pdf");
}

using System.Threading.RateLimiting;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.RateLimiting;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddProblemDetails();

builder.Services.AddRateLimiter(options =>
{
    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
    options.AddConcurrencyLimiter("exports", limiter =>
    {
        limiter.PermitLimit = 4;   // the reporting replica handles four exports at a time
        limiter.QueueLimit = 0;
    });

    options.OnRejected = async (context, cancellationToken) =>
    {
        var http = context.HttpContext;
        http.RequestServices.GetRequiredService<ILoggerFactory>()
            .CreateLogger("RateLimiting")
            .LogWarning("Rejected {Method} {Path} for {User}", http.Request.Method, http.Request.Path,
                http.User.Identity?.Name ?? "anonymous");

        http.Response.Headers.RetryAfter = "10"; // concurrency leases carry no RetryAfter metadata
        await http.RequestServices.GetRequiredService<IProblemDetailsService>().WriteAsync(new ProblemDetailsContext
        {
            HttpContext = http,
            ProblemDetails = new ProblemDetails
            {
                Status = StatusCodes.Status429TooManyRequests,
                Title = "Too many concurrent exports",
                Detail = "Four exports are already running. Try again shortly."
            }
        });
    };
});

var app = builder.Build();
app.UseRateLimiter();

app.MapGet("/reports/sales.csv", async (CancellationToken ct) =>
{
    await Task.Delay(TimeSpan.FromSeconds(20), ct); // stands in for a heavy query
    return TypedResults.Text("orderId,total\n1001,129.90\n", "text/csv");
}).RequireRateLimiting("exports");

app.Run();