Summary
Implement `System.Threading.RateLimiting.RateLimiter` backed by Redis for distributed rate limiting across multiple app instances.
Problem
.NET 8's `RateLimiting` middleware is in-memory by default. In a multi-instance deployment, each instance has its own counter — so a limit of 100 req/min becomes 100×N. Redis-backed rate limiting solves this.
Proposed Algorithms
Fixed Window
```csharp
services.AddRedisFixedWindowRateLimiter("api", options =>
{
options.Window = TimeSpan.FromMinutes(1);
options.PermitLimit = 100;
});
```
Sliding Window
```csharp
services.AddRedisSlidingWindowRateLimiter("api", options =>
{
options.Window = TimeSpan.FromMinutes(1);
options.PermitLimit = 100;
options.SegmentsPerWindow = 6;
});
```
Implementation
- Use `StringIncrementAsync` with TTL for fixed window
- Use Lua script for sliding window (atomic check-and-increment)
- Consider a separate package: `StackExchange.Redis.Extensions.RateLimiting`
Considerations
Summary
Implement `System.Threading.RateLimiting.RateLimiter` backed by Redis for distributed rate limiting across multiple app instances.
Problem
.NET 8's `RateLimiting` middleware is in-memory by default. In a multi-instance deployment, each instance has its own counter — so a limit of 100 req/min becomes 100×N. Redis-backed rate limiting solves this.
Proposed Algorithms
Fixed Window
```csharp
services.AddRedisFixedWindowRateLimiter("api", options =>
{
options.Window = TimeSpan.FromMinutes(1);
options.PermitLimit = 100;
});
```
Sliding Window
```csharp
services.AddRedisSlidingWindowRateLimiter("api", options =>
{
options.Window = TimeSpan.FromMinutes(1);
options.PermitLimit = 100;
options.SegmentsPerWindow = 6;
});
```
Implementation
Considerations