Bits of .NET

The Trap: Most developers dutifully add a Rate Limiter to their API to prevent abuse. However, they often make a critical mistake: they set a Global Limit.

If you set a limit of “1000 requests per minute” globally, a single malicious bot can use up all 1000 requests in 5 seconds. The result? Your legitimate users get hit with 429 Too Many Requests errors, even though they did nothing wrong. This is known as the “Noisy Neighbor” problem.

The Fix: You need Partitioning. Instead of one counter for the whole app, you need a separate counter for each user (or IP address).

---

✔ The Correct Approach (.NET 7+)

Here is how to implement a partitioned limiter that tracks usage per IP address. This ensures that if one IP goes rogue, only that IP is throttled, while everyone else enjoys full speed.

builder.Services.AddRateLimiter(options =>
{
    options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>(httpContext =>
        RateLimitPartition.GetFixedWindowLimiter(
            // Partition by IP Address
            partitionKey: httpContext.Connection.RemoteIpAddress?.ToString() ?? "anonymous",
            factory: partition => new FixedWindowRateLimiterOptions
            {
                AutoReplenishment = true,
                PermitLimit = 100, // 100 requests...
                Window = TimeSpan.FromMinutes(1) // ...per minute, PER IP.
            }));
});