Rate limiting middleware: configuring fixed window and per-user policies

APIs without rate limiting are vulnerable to abuse and denial-of-service attacks. Implementing rate limiting manually in every handler is inconsistent and bypassed easily.

Use the built-in ASP.NET Core rate limiting middleware (.NET 7+):

builder.Services.AddRateLimiter(options =>
{
    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;

    // Global fixed window policy
    options.AddFixedWindowLimiter("global", opt =>
    {
        opt.Window = TimeSpan.FromMinutes(1);
        opt.PermitLimit = 100;
        opt.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
        opt.QueueLimit = 10;
    });

    // Per-user policy using partition key
    options.AddPolicy("perUser", ctx =>
        RateLimitPartition.GetFixedWindowLimiter(
            partitionKey: ctx.User.Identity?.Name ?? ctx.Connection.RemoteIpAddress?.ToString() ?? "anon",
            factory: _ => new FixedWindowRateLimiterOptions
            {
                Window = TimeSpan.FromMinutes(1),
                PermitLimit = 30
            }));
});

app.UseRateLimiter();

// Apply to endpoint
app.MapPost("/api/orders", handler).RequireRateLimiting("perUser");

The rate limiter uses System.Threading.RateLimiting primitives which are partition-aware and support queuing. Requests exceeding limits are either rejected immediately or queued depending on QueueLimit.