YARP VS AspNetCoreRateLimit

Adding to the other answers here, you might find some useful functionality in YARP if you want a pure .NET reverse proxy. Like Kestrel, Microsoft dogfoods YARP in Azure.

➡️ Release 2.0.0-RC.1 · microsoft/reverse-proxy · GitHub ➡️ Visual Studio 2022 17.5 Preview 3 is here!

In your application, you may be using YARP, to build a reverse proxy gateway sitting in front of various backend applications. For example, you may run YARP to listen on example.org, and have it proxy all requests going to this domain while mapping /api and /docs to different web apps running on diffreent servers.

Microsoft already made YARP for their Azure infrastructure, it's a "build your own reverse proxy" kit.

If I was to need one I would probably reach for YARP (Yet Another Reverse Proxy) from MS. https://microsoft.github.io/reverse-proxy/

Microsoft's YARP is exactly this.

AFAIK the new built-in rate limiting only supports in-memory counters at the moment. You will need to use the old open source rate limiting package instead: https://github.com/stefanprodan/AspNetCoreRateLimit

In this post, I wanted to give you some insights about how you can use the ASP.NET Core rate limiting middleware. It’s not as complete as Stefan Prodan’s AspNetCoreRateLimit, but there are enough options available to add rate limiting to your application.

Have a look at this package: https://github.com/stefanprodan/AspNetCoreRateLimit

Eventually I got around to implementing rate limiting on the endpoints, for the dotnet Core WebApi it is really easy to add thanks to the AspNetCoreRateLimit NuGet package. I chose to limit the endpoint to 2 requests per second, per IP Address as well as a limit of 10 requests per 30 seconds per IP Address. Then on the front end I added some messages to let the user know that they are being rate limited and we also limit their ability to spam the same emoji multiple times.