API Security Challenge: Implement Rate Limiting in ASP.NET Core

Design and implement a robust rate-limiting solution in ASP.NET Core to safeguard REST APIs against abuse and denial-of-service (DoS) attacks.

Requirements

• Implement request rate limiting at the API level
• Support limits based on:
  • Client IP address
  • API key or authenticated user
• Configure different rate-limit policies (e.g., fixed window, sliding window, token bucket)
• Return appropriate HTTP responses (429 Too Many Requests) with retry information
• Ensure the solution is thread-safe and performant
• Make the rate limits configurable via appsettings.json

Advanced Expectations (Bonus)

• Use ASP.NET Core Rate Limiting Middleware or a custom implementation
• Integrate with Redis or in-memory cache for distributed scenarios
• Apply different rate-limit rules per endpoint
• Log and monitor throttled requests
• Demonstrate graceful degradation under high traffic

Deliverables

• Working ASP.NET Core Web API project
• Clean, well-structured code following best practices
• Example configuration and usage documentation
• Brief explanation of the chosen rate-limiting strategy and trade-offs

Skills Demonstrated

• API security and resilience
• ASP.NET Core middleware and filters
• Performance optimization
• Scalable system design