ASP.NET Core 10 ships a revised rate-limiting implementation that reduces allocation overhead and adds native sliding-window support. The changes let teams enforce limits directly in the pipeline while retaining sub-millisecond decision times.

The update replaces earlier token-bucket defaults with a configurable sliding-window policy that tracks requests over precise time windows. Endpoint-level metrics are now exposed through the existing diagnostic listener, removing the need for custom counters.

#Configuring the New Policy

Register the middleware in Program.cs and select the sliding-window limiter. The following snippet shows the minimal setup for a 100-request-per-minute window with a 10-request burst allowance.

csharp 
builder.Services.AddRateLimiter(options =>
{
    options.AddSlidingWindowLimiter("default", cfg =>
    {
        cfg.PermitLimit = 100;
        cfg.Window = TimeSpan.FromMinutes(1);
        cfg.SegmentsPerWindow = 6;
        cfg.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
        cfg.QueueLimit = 10;
    });
});

#Applying Limits per Endpoint

Use the EnableRateLimiting attribute or convention-based metadata to scope policies. This approach keeps global configuration clean while allowing different limits for authenticated versus anonymous routes.

  • Apply [EnableRateLimiting("default")] to controller actions or minimal API endpoints.
  • Override policy name via endpoint metadata for fine-grained control.
  • Expose current usage through the RateLimitMetrics diagnostic source.

#Observability and Tuning

ASP.NET Core 10 emits rate-limit rejection events with enriched tags including policy name and remaining quota. Wire these events to OpenTelemetry to surface real-time throttling data in dashboards.

Start with conservative windows, then adjust segment count and queue depth after reviewing production telemetry for two weeks. Avoid overly granular windows that increase memory pressure without measurable protection.

#Migration Notes

Existing RateLimiterOptions instances continue to function. Replace any custom FixedWindowLimiter registrations with SlidingWindowLimiter when sub-minute granularity is required. Remove third-party rate-limiting packages that duplicate the built-in behavior.

Test the new configuration under load using tools such as k6 or Bombardier before deploying to production. The reduced allocation footprint typically yields a measurable drop in garbage-collection pauses for high-throughput services.