What is rate limiting in ASP.NET Core 7?

Question

Accepted Answer

**Rate limiting** — control request frequency.

**Setup:**
```csharp
// Program.cs
builder.Services.AddRateLimiter(options =>
{
    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;

// Fixed window
    options.AddFixedWindowLimiter("fixed", opt =>
    {
        opt.Window = TimeSpan.FromSeconds(10);
        opt.PermitLimit = 100;
    });

// Sliding window
    options.AddSlidingWindowLimiter("sliding", opt =>
    {
        opt.Window = TimeSpan.FromSeconds(60);
        opt.SegmentsPerWindow = 6;
        opt.PermitLimit = 100;
    });

// Token bucket
    options.AddTokenBucketLimiter("token", opt =>
    {
        opt.TokenLimit = 100;
        opt.ReplenishmentPeriod = TimeSpan.FromSeconds(10);
        opt.TokensPerPeriod = 10;
    });
});

app.UseRateLimiter();
```

**Per-endpoint:**
```csharp
app.MapGet("/api/data", GetData)
    .RequireRateLimiting("fixed");
```

**Custom policy:**
```csharp
// Limit per user
var userPolicy = new RateLimiterOptions()
    .AddPolicy("perUser", context =>
    {
        var userId = context.User.FindFirst("sub")?.Value;
        return RateLimitPartition.GetTokenBucketLimiter(
            userId, _ => new TokenBucketRateLimiterOptions
            {
                TokenLimit = 100,
                ReplenishmentPeriod = TimeSpan.FromMinutes(1)
            });
    });
```

C#: What is rate limiting in ASP.NET Core 7?