Wallero.RateLimiting 1.0.0

Wallero.RateLimiting

Copyright

Copyright (c) Wallero Technologies (2025-present). All rights reserved.

A production-ready, flexible IP and route-based rate-limiting middleware package for Wallero Technologies applications, providing robust throttling with license validation and configuration from appsettings.json.

Installation

Install the package via NuGet:

dotnet add package Wallero.RateLimiting --version 1.0.0

Configuration

Configure settings in your appsettings.json and appsettings.Development.json:

appsettings.json

{
  "WalleroConfiguration": {
    "LicenseKey": "Wallero-License-2025-Secure"
  },
  "RateLimitingSettings": {
    "SpecificPaths": [
      "/Authentication/SignIn",
      "/Authentication/SignUp"
    ],
    "GeneralControllerPaths": [
      "/User"
    ],
    "MinuteLimit": 20,
    "MinutePeriod": 1,
    "HourLimit": 200,
    "HourPeriod": 1,
    "SpecificLimit": 100,
    "SpecificMinutesPeriod": 5,
    "GeneralLimit": 150,
    "GeneralMinutesPeriod": 5,
    "ApiCallTime": 5
  }
}

appsettings.Development.json

{
  "RateLimitingSettings": {
    "SpecificPaths": [
      "/Authentication/SignIn",
      "/Authentication/SignUp"
    ],
    "GeneralControllerPaths": [
      "/User"
    ],
    "MinuteLimit": 100,
    "MinutePeriod": 5,
    "HourLimit": 10000,
    "HourPeriod": 1,
    "SpecificLimit": 5000,
    "SpecificMinutesPeriod": 5,
    "GeneralLimit": 5000,
    "GeneralMinutesPeriod": 5,
    "ApiCallTime": 5
  }
}

Setup

Add to your Program.cs:

using Wallero.RateLimiting.Extensions;

var builder = WebApplication.CreateBuilder(args);

// Add controllers
builder.Services.AddControllers();
builder.Services.AddHttpContextAccessor();

// Add Wallero Rate Limiting
builder.Services.AddWalleroRateLimiting(builder.Configuration);

var app = builder.Build();

// Use rate limiting middleware (before authentication)
app.UseWalleroRateLimiting();

app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

app.Run();

Rate Limiting Types

The middleware applies different rate limiting strategies based on request paths:

1. Specific Path Rate Limiting

Paths listed in SpecificPaths have both minute and hour-based limits:

• Minute Limit: Max requests per minute period
• Hour Limit: Max requests per hour period

2. Controller-Based Rate Limiting

Paths starting with any path in GeneralControllerPaths are rate limited per controller:

• Specific Limit: Max requests per controller within the specified period

3. General Rate Limiting

All other paths fall under general rate limiting:

• General Limit: Max requests per path within the specified period

4. API Call Time Monitoring

Monitors API response times and logs warnings for slow endpoints exceeding ApiCallTime threshold.

Configuration Parameters

Usage

Basic Usage

Once configured, the middleware automatically applies rate limiting to all incoming requests based on:

• Client IP address
• Request path
• Configured limits

Testing Rate Limits

Create a test controller to validate rate limiting:

[ApiController]
public class RateLimitTestController : ControllerBase
{
    [HttpGet("/Authentication/SignIn")]
    public IActionResult TestSignIn()
    {
        return Ok("SignIn endpoint reached");
    }

    [HttpGet("/User/Dashboard")]
    public IActionResult TestUserDashboard()
    {
        return Ok("User Dashboard reached");
    }

    [HttpGet("/General/Test")]
    public IActionResult TestGeneral()
    {
        return Ok("General endpoint reached");
    }
}

Response Format

When rate limits are exceeded, the middleware returns HTTP 429 with JSON response:

{
  "StatusCode": 429,
  "IsSuccess": false,
  "Error": "You have exceeded the allowed attempts. Please try again later."
}

Features

• Multi-Level Rate Limiting: Specific paths, controller-based, and general rate limiting
• IP-Based Tracking: Prevents abuse from individual IP addresses
• Wallero License Integration: Secure license validation using shared WalleroConfiguration
• Configurable Settings: All limits managed through appsettings.json
• Development vs Production: Different rate limits for development and production environments
• Memory Management: Automatic cleanup of expired request counters every 5 minutes
• Performance Monitoring: Logs warnings for API calls exceeding time thresholds
• Thread-Safe: Uses ConcurrentDictionary for safe concurrent access
• Flexible Configuration: Override settings via action delegate in service registration

Environment Behavior

• Development: Higher limits for easier testing and development
• Production: Stricter limits for security and resource protection
• Automatic Cleanup: Expired rate limit entries are cleaned up every 5 minutes

License

This project is licensed under the MIT License and requires a valid Wallero license key.

Contact

For support, contact Wallero Technologies at support@wallero.com