WebApiThrottle

By default, rejected (throttled) calls are not added to the throttle counter. If you want rejected requests to count towards the limits (e.g., to prevent a client from spamming even if they are already blocked), set StackBlockedRequests = true in the ThrottlePolicy.

config.MessageHandlers.Add(new ThrottlingHandler()
{
	Policy = new ThrottlePolicy(perSecond: 1, perMinute: 30)
	{
		IpThrottling = true,
		ClientThrottling = true,
		EndpointThrottling = true,
		StackBlockedRequests = true
	},
	Repository = new CacheRepository()
});

To throttle based on a combination of IP and a unique API key, set IpThrottling, ClientThrottling, and EndpointThrottling to true. If you want to apply limits to clients regardless of their IP, set IpThrottling to false.

config.MessageHandlers.Add(new ThrottlingHandler()
{
	Policy = new ThrottlePolicy(perSecond: 1, perMinute: 30)
	{
		IpThrottling = true,
		ClientThrottling = true,
		EndpointThrottling = true
	},
	Repository = new CacheRepository()
});

For OWIN-based applications (e.g., targeting endpoints outside the Web API area like SignalR or OAuth), use ThrottlingMiddleware. It functions similarly to the ThrottlingHandler.

// IIS Hosted OWIN Example
public class Startup
{
    public void Configuration(IAppBuilder appBuilder)
    {
        appBuilder.Use(typeof(ThrottlingMiddleware),
            ThrottlePolicy.FromStore(new PolicyConfigurationProvider()),
            new PolicyCacheRepository(),
            new CacheRepository(),
            null,
            null);
    }
}

To apply rate limits to specific routes rather than globally, set both IpThrottling and EndpointThrottling to true in the ThrottlePolicy. This ensures that a request to one route does not consume the quota for a different route.

config.MessageHandlers.Add(new ThrottlingHandler()
{
	Policy = new ThrottlePolicy(perSecond: 1, perMinute: 30)
	{
		IpThrottling = true,
		EndpointThrottling = true
	},
	Repository = new CacheRepository()
});

If you prefer decorating controllers or actions with attributes, use ThrottlingFilter and EnableThrottlingAttribute. This allows you to specify custom limits directly on your API methods.

Note: ThrottlingHandler executes earlier in the Web API request pipeline than ThrottlingFilter. Use the handler unless you specifically need the attribute-based features.

You can bypass throttling for specific IPs or Client Keys by using IpWhitelist and ClientWhitelist. The IpWhitelist supports IPv4 and IPv6 ranges (e.g., 192.168.0.0/24, fe80::/10) and ranges (e.g., 192.168.0.0-192.168.0.255). Whitelisted requests are not stored in the throttle counters.

config.MessageHandlers.Add(new ThrottlingHandler()
{
	Policy = new ThrottlePolicy(perSecond: 2, perMinute: 60)
	{
		IpThrottling = true,
		IpWhitelist = new List<string> { "::1", "192.168.0.0/24" },
		
		ClientThrottling = true,
		ClientWhitelist = new List<string> { "admin-key" }
	},
	Repository = new CacheRepository()
});

To update the ThrottlePolicy without restarting the application, you must use the ThrottlingHandler constructor that accepts an IPolicyRepository. You can then use the static ThrottleManager.UpdatePolicy method to apply changes.

// 1. Register with PolicyRepository
config.MessageHandlers.Add(new ThrottlingHandler(
    policy: new ThrottlePolicy(perMinute: 20) { IpThrottling = true },
    policyRepository: new PolicyCacheRepository(),
    repository: new CacheRepository()));

// 2. Update anywhere in your code
public void UpdateRateLimits()
{
    var policyRepository = new PolicyCacheRepository();
    var policy = policyRepository.FirstOrDefault(ThrottleManager.GetPolicyKey());

    policy.ClientRules["api-client-key-1"] = new RateLimits { PerMinute = 80, PerHour = 800 };
    
    ThrottleManager.UpdatePolicy(policy, policyRepository);
}

WebApiThrottle is an ASP.NET Web API throttling handler, OWIN middleware, and filter. You can install it using the NuGet package manager.

Package URL: nuget.org/packages/WebApiThrottle

By default, ThrottlingHandler looks for the client API key in the Authorization-Token request header. To use a different header or logic, inherit from ThrottlingHandler and override the SetIdentity method.

public class CustomThrottlingHandler : ThrottlingHandler
{
	protected override RequestIdentity SetIdentity(HttpRequestMessage request)
	{
		return new RequestIdentity()
		{
			ClientKey = request.Headers.Contains("Authorization-Key") ? request.Headers.GetValues("Authorization-Key").First() : "anon",
			ClientIp = base.GetClientIp(request).ToString(),
			Endpoint = request.RequestUri.AbsolutePath.ToLowerInvariant()
		};
	}
}