How to rate limit (throttle) your ASP.NET Core API

[@yangeruch1958]

Would love to see more content about security.

[@qizhang5749]

I'd like to see an implementation of an Token server for single sign on. Not alot of content for that.

[@robertocolombo9917]

@@qizhang5749 May i suggest you look into Identity Server 4? It is a great and customizable framework, i think it might fit your needs :)

[@JohannGambolputty86]

Nothing to do with this video, all of them you make are extraordinary indeed, but just wanted to say, you are killing us, when I say us I mean us (Java Developers). You really sometimes make me believe that nothing can be compared with C#... Yes, yes... I know the old good saying "You know, everything has its own purpose, and depends where and how you use it. :)", Again, Brilliant work Nick. Euxaristume!

[@sywor]

It would be nice if the configuration of each endpoint could set through attributes on the endpoint method instead of using json config.

[@haha-hk9tx]

Had this in mind, and you came in clutch... can't believe it is that easy...

[@bartekm3878]

Exactly what I was looking for! Awesome video! Thank you so much!

[@hernanar3647]

Nick, you are amazing, is incredible how you can be serious and funny at the moment of teach. And that gives a lot of points, because when i see your videos you have all my atention. Keep coding ¡Eres el mejor! :)

[@thiagomatu]

Amazing video as always Nick, thanks for sharing this knowledge with us!

[@fifty6737]

this library is perfect, very well thought out

[@sunilanthony17]

It's like you were reading my mind. This is the exact topic I was going to research. Thank you.

[@curiosity9283]

I keep telling my self where did I see you, your voice and actions is very familiar, today I found it. you are pretty much the same as Ivar the boneless in the Viking series. thanks for the video I appreciate the help

[@jaredlash5002]

Something I would like to see is how to consume a rate limited API. There's tons of stuff on creating rate limited APIs for others to consume, not much from the consumer's side.

[@FraserMcLean81]

Awesome video, thanks Nick! This will help me in a project I am planning in the near future. Love your content, keep it up!

[@girish9841]

Absolutely amazing thank you

[@Aphradity]

Excellent video Nick. Very informative.

[@jackkendall6420]

I was just looking for how to do this the other day, pog.

Enjoying your vids!! Can you make one implementing an API developer key administration that supports expiration and retracting the keys

[@Marko-wb2lx]

Awesome Nick, WE LOVE YOU!!!

[@BrammyS]

Yesss, I was waiting for this one!

[@aniljha6106]

That's great. I would love to see how can i implement this on previous version of .Net

[@varsharathode8560]

Life saver🥰🥰

[@jyotibannigidad876]

That's Great Stuff!! Thanks.

[@00kleberson]

Awesome content, thanks for sharing!

[@stevemcqueen2887]

If you have a proxy like Nginx or a Web Application Firewall infront of your App it will probably be better to use their rate limiting capabilities.

[@alexanderspiegel6747]

Interesting… thanks. It is good to know

[@mahsahashempoor3644]

Thank you.it was so usuful

[@SaadZafar2]

Really liked your explanation. Just 2 questions. Can we use MongoDB instead of Redis? How can we see the number of requests per client for reporting or monitoring purposes?

[@harrylyod3402]

always love your contents

[@krishna65able]

Hello nick we havent discuss about client rules here?

[@mihaimyh]

Nice video, thanks! Any video plans about background task scheduling in .NET?

[@solracepilif]

First of all, thank you so much for your videos! They are very helpfull. 👏👏 So, I'm trying use this package and I follow everything as you show but when I make a request for my API I didn't get the response headers related to the throttling. Any idea what could be? I missing something? It as a simple ASP Web API .NET 5 project. Thank you!

[@vibhoregupta1742]

Always love your content. I have a question here. Can i do such configuration at IIS level, like defining route based rate limiting based on client ip. I ended up creating an action filter that interacts with redis to achieve distributed ip based rate limiting and using that filter on action methods.

[@karvan101]

What window is this? NuGet: Packages It does not looks like nuget package manager one

[@nasrullahnasrullah409]

clientRateLimit for Policies not working ? correct ?

[@ravan01d]

Good tutorial. But, how do we determine the rate limiting request numbers?

[@nickchapsas]

This is up to the system. It's how much you wanna allow for example

[@JakeAndDaddy]

If it’s relying on headers to track requests it’s going to be very easy to workaround. Something like NGINX as a reverse proxy would do this properly.

[@nickchapsas]

Since the header can only be set by the load balancer any user input would be overridden so it would be impossible to workaround if configured properly. It’s equally easy to spoof your request IP as a workaround

[@sushantjadhav9525]

I use Azure API management to rate limit the requests

[@nickchapsas]

That's a solid point. I should have mentioned that rate limiting can also happen on the load balancer which means that the app's performance doesn't have to take a hit. Thanks for raising it

[@ClAddict]

@@nickchapsas would be curious to know the demoed redis backed rate-limit libraries scale limitations are for distributed systems. I also use Apim at work, but it can barely keep up with the throughput our customers demand. A couple families could live quite comfortably on what we spend on apim a month as is, so alternatives are always interesting.

[@nickchapsas]

@@ClAddict Redis can scale alongside your application's needs with relativelyminimal medal behind it. I would personally go with a managed Redis cluster and let it rip

[@mahesh_rcb]

Nice 👍🏻 Will it impact overall performance ??

[@nickchapsas]

It's a middleware that does a lookup every time a request is coming in, so yeah it will but there is no way this feature wouldn't impact performance so it's necessary evil.

[@phyberoptyk5619]

Good stuff. But how can a consumer now rate limit itself to this rate limited API? Across multiple nodes? Know of a nuget package that is this easy to wire into httpclient? Because we’ve rolled our own. Badly.

[@nickchapsas]

You can use the response headers from the client to know how to limit yourself.

[@reneschindhelm4482]

Yeah, I think Nick is right. You can inspect the HTTP response status code (429 Too many requests) and the headers returned from the API. Maybe you can utilize Polly and it’s retry policy to attempt to re-send the http request on the client side of things.

[@ibrahimhasan8054]

But isn't this will require me to publish every single time I change something in the appsettings configurations.

[@nickchapsas]

No for 2 reasons. Firstly, .NET supports runtime update of appsettings so depending on how you manage settings you don't need to redeploy. Secondly, the package supports runtime changes on all those settings so you could save them in a db and load them on startup and update them while the app is live

[@ibrahimhasan8054]

@@nickchapsas That is really powerful Thank you Nick

[@clearlyunwell]

👍🏽

[@1285215]

Excelent video, do you have a load balancer tutorial btw? thankss

[@nickchapsas]

I have something in the backlog but I don't know if I wanna do it with Azure, AWS or cloud agnostic technologies

[@callindrill]

@@nickchapsas my vote is azure, but then again... Why not both? :)

[@yavuz1695]

Can you do some kotlin videos please? Or can you suggest someone?