How do I implement rate limiting in an ASP.NET MVC site?

Question

I'm building an ASP.NET MVC site where I want to limit how often authenticated users can use some functions of the site.

Although I understand how rate-limiting works fundamentally, I can't visualize how to implement it programatically without creating a major code smell.

Can you point me towards a simple yet powerful solution for approaching such a problem, with C# sample code?

If it matters, all of these functions are currently expressed as Actions that only accept HTTP POST. I may eventually want to implement rate-limiting for HTTP GET functions as well, so I'm looking for a solution that works for all such circumstances.

Here is another complete tutorial how to do it, which allows more flexible intervals: shieldui.com/blogs/rate-limiting-in-asp-net-mvc — Vladimir Georgiev
– Vladimir Georgiev, Commented Jan 5, 2016 at 12:44

Darin Dimitrov · Accepted Answer · 2010-06-21 07:57:17Z

40

If you are using IIS 7 you could take a look at the Dynamic IP Restrictions Extension. Another possibility is to implement this as an action filter:

[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
public class RateLimitAttribute : ActionFilterAttribute
{
    public int Seconds { get; set; }

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        // Using the IP Address here as part of the key but you could modify
        // and use the username if you are going to limit only authenticated users
        // filterContext.HttpContext.User.Identity.Name
        var key = string.Format("{0}-{1}-{2}",
            filterContext.ActionDescriptor.ControllerDescriptor.ControllerName,
            filterContext.ActionDescriptor.ActionName,
            filterContext.HttpContext.Request.UserHostAddress
        );
        var allowExecute = false;

        if (HttpRuntime.Cache[key] == null)
        {
            HttpRuntime.Cache.Add(key,
                true,
                null,
                DateTime.Now.AddSeconds(Seconds),
                Cache.NoSlidingExpiration,
                CacheItemPriority.Low,
                null);
            allowExecute = true;
        }

        if (!allowExecute)
        {
            filterContext.Result = new ContentResult
            {
                Content = string.Format("You can call this every {0} seconds", Seconds)
            };
            filterContext.HttpContext.Response.StatusCode = (int)HttpStatusCode.Conflict;
        }
    }
}

And then decorate the action that needs to be limited:

[RateLimit(Seconds = 10)]
public ActionResult Index()
{
    return View();
}

edited Jun 21, 2010 at 7:57

answered Jun 21, 2010 at 7:48

Darin Dimitrov

1.0m275 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Stuart Blackler Over a year ago

How would you extend this to use 429 - Too Many Requests as per RFC 6586

NicholasFolk Over a year ago

@StuartBlacker I would assume you would edit the following line: filterContext.HttpContext.Response.StatusCode = (int)HttpStatusCode.Conflict; from Conflict to a 429 error.

Pangamma Over a year ago

Great solution here. I love it. I'm going to see if I can do sth (something) similar. Maybe sth with an LRU or sliding window timeout.

Mark Good Over a year ago

filterContext.Result = new HttpStatusCodeResult(429, "too many requests");

Mark Good Over a year ago

We tried this and encountered problems with users having the same IP address, such as multiple users connecting from the same large organization (Ford, for example.) There are other attributes of the request that we could use, but all of the ones I have seen so far are "spoofable" (user-agent, SessionID, request headers, etc.)

|

Community · Accepted Answer · 2017-05-23 12:02:31Z

5

Have a look at Jarrod's answer on how they do this on SO.

StackOverflow MVC Throttling

Some example code as well as explanation on how it works.

edited May 23, 2017 at 12:02

CommunityBot

11 silver badge

answered Jun 21, 2010 at 10:56

Tommy

39.9k10 gold badges93 silver badges125 bronze badges

2 Comments

Shaiju T Over a year ago

I have a doubt , What if does DOS attack hits the web server, then how come this code level protection will help ? Doesn't we need solution on web server or machine level ?

Tommy Over a year ago

@stom - If the DOS attack is making to your webservers, you have already lost a decent amount of the battle. Even if the web server simply drops the packets, the attack is till tying up bandwidth and server resources to listen, inspect and drop the packet(s). Rate Limiting is more to prevent abuse from a single user or bots, not necessarily a total defense against DOS attacks though it may help a bit in that you're not executing DB calls/functions for every request like you would with no rate throttling in place.

sa-es-ir · Accepted Answer · 2022-03-10 13:07:48Z

3

.Net 6

Check it out:

Nuget: https://www.nuget.org/packages/DotNetRateLimiter/

It is simple:

[HttpGet("")]
[RateLimit(PeriodInSec = 60, Limit = 3)]
public IEnumerable<WeatherForecast> Get()
{
    ....
}

And even you can control request by route or query parameters:

[HttpGet("by-query/{id}")]
[RateLimit(PeriodInSec = 60, Limit = 3, RouteParams = "id", QueryParams = "name,family")]
public IEnumerable<WeatherForecast> Get(int id, string name, [FromQuery] List<string> family)
{
    ....
}

answered Mar 10, 2022 at 13:07

sa-es-ir

5,1902 gold badges20 silver badges38 bronze badges

Collectives™ on Stack Overflow

How do I implement rate limiting in an ASP.NET MVC site?

3 Answers 3

6 Comments

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

6 Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related