Blog

Rate Limiting in Depth: Algorithms, Partition Keys, Chained Limiters and Multiple Instances

ASP.NET Core rate limiters live in process memory: two instances double the limit, and behind a proxy without the real IP everyone lands in one partition. We compare fixed window, sliding window and token bucket under the same traffic, then show queue order, partition keys, CreateChained, 429 instead of the default 503 with Retry-After, the shared-policy trap and a per-user-name login limit with real output.