A public form invites people to submit it a thousand times a minute, by accident, out of curiosity or on purpose. Rate limiting decides how often someone may do something and turns away everything above that in a friendly way. In K2 2.6.6 you already limited the public booking. In this lesson you look more closely: which algorithm fits what, who is “someone” when the Kladde runs behind a proxy, what the rejected visitor sees, and how the Kladde itself behaves toward services that have limits of their own.
You need a new package only for the tests: Microsoft.AspNetCore.TestHost in version 10.0.14. Rate limiting itself is part of
ASP.NET Core, and the algorithms come from System.Threading.RateLimiting.
Four algorithms
AddRateLimiter knows four algorithms. They differ in what they count and how they divide up time:
| Algorithm | Options | What it counts | Good for |
|---|---|---|---|
| Fixed window | PermitLimit, Window |
at most N requests per window; the count starts over with the next window | simple limits such as “five bookings a minute” |
| Sliding window | plus SegmentsPerWindow |
like the fixed one, but the window moves on in segments; old segments drop out one at a time | limits without a double peak at the window boundary |
| Token bucket | TokenLimit, TokensPerPeriod, ReplenishmentPeriod |
a bucket of tokens; each request takes one, refilled at a fixed pace | allowing short bursts while keeping a pace in the long run |
| Concurrency | PermitLimit |
how many requests run at the same time, with no time window | expensive work of which never more than N should run at once |
All four know QueueLimit: how many requests may wait instead of being rejected at once. For a public form, 0 is right, because a visitor
should get a clear answer and not hang in a queue. For expensive internal work a small queue can be friendlier.
You should know the double peak of the fixed window: with “five per minute” someone can send five requests in the last second of one minute and five more in the first second of the next, so ten in two seconds. For the booking that is harmless. Where it matters, you use the sliding window, which divides the minute into, say, six segments of ten seconds.