Rate Limiting
Problem
- An ASP.NET Core API gets hit by one client 500 times in a few seconds.
- Every request reaches the endpoint and gets processed. The database and CPU absorb the full flood.
- Every other client calling the API now waits longer for every request, even though they did nothing wrong.
One client's traffic degrades the service for everyone.
Solution
Rate Limiting
- Count each client's requests against a limit, say 100 per minute.
- Once a client crosses the limit, reject its further requests immediately with a 429.
- The rejection happens in middleware, before the request ever reaches the endpoint.
Other clients keep normal response times, because the flood never reaches the database.
A client that can call your API as fast as it wants eventually will. Rate limiting caps it before it caps you.
Analogy
In rush hour, a metro station lets a fixed number of people through the gates per minute. When the platform is full, the gates hold newcomers outside until space clears.
The trains keep running on time for the people already inside, and the platform never gets crushed.
Rate limiting is the station gate for your API.
