RedisRateLimiting for ASP.NET Core

This library provides four primary rate limiting strategies to handle different traffic patterns:

• Concurrent Requests: Limits the number of active, in-progress requests. Best for protecting resource exhaustion.
• Fixed Window: Resets the limit after a specific time interval (e.g., 100 requests every 1 minute). Simple but can allow bursts at window boundaries.
• Sliding Window: A more precise version of Fixed Window that tracks requests relative to the current timestamp, preventing bursts at window edges.
• Token Bucket: Allows for bursts up to a certain limit (TokenLimit) while maintaining a steady average rate via periodic replenishment (TokensPerPeriod over ReplenishmentPeriod).

To use this library in an ASP.NET Core application, install the following NuGet packages:

1. RedisRateLimiting: The core library.
2. RedisRateLimiting.AspNetCore: The ASP.NET Core integration package.

Requirements:

• Target Framework: net7.0 or net8.0
• Dependencies: StackExchange.Redis, System.Threading.RateLimiting

PM> Install-Package RedisRateLimiting
PM> Install-Package RedisRateLimiting.AspNetCore

The Fixed Window algorithm applies a limit over a specific, fixed time window. Once the window expires, the limit resets to its starting point.

Use the AddRedisFixedWindowLimiter extension method to configure this strategy.

builder.Services.AddRateLimiter(options =>
{
    options.AddRedisFixedWindowLimiter("demo_fixed_window", (opt) =>
    {
        opt.ConnectionMultiplexerFactory = () => connectionMultiplexer;
        opt.PermitLimit = 1;
        opt.Window = TimeSpan.FromSeconds(2);
    });
});

The Token Bucket algorithm uses a bucket that holds a maximum number of tokens. Each request consumes a token. Tokens are replenished at a fixed rate over a specific period. If the bucket is empty, requests are denied.

Use the AddRedisTokenBucketLimiter extension method to configure this strategy.

builder.Services.AddRateLimiter(options =>
{
    options.AddRedisTokenBucketLimiter("demo_token_bucket", (opt) =>
    {
        opt.ConnectionMultiplexerFactory = () => connectionMultiplexer;
        opt.TokenLimit = 2;
        opt.TokensPerPeriod = 1;
        opt.ReplenishmentPeriod = TimeSpan.FromSeconds(2);
    });
});

The Concurrency Rate Limiter restricts how many requests can access a resource simultaneously. For example, a limit of 20 means only 20 requests can be in progress at once; the 21st request is denied until one of the active requests completes.

Use the AddRedisConcurrencyLimiter extension method to configure this strategy.

builder.Services.AddRateLimiter(options =>
{
    options.AddRedisConcurrencyLimiter("demo_concurrency", (opt) =>
    {
        opt.ConnectionMultiplexerFactory = () => connectionMultiplexer;
        opt.PermitLimit = 5;
        // Queue requests when the limit is reached
        //opt.QueueLimit = 5 
    });
});