Rate Limiter

Capping the number of API requests per unit of time — so that a load spike or a client gone rogue doesn't take the service down. Algorithms to pick from: fixed window, sliding window, token bucket, concurrency limiting.

We put together an experiment to see how this lives in .NET: took AspNetCoreRateLimit for a spin — per-IP and per-client limits are attached as middleware and driven by config — and on the client side we looked at the rate-limit policy in Polly. Works predictably, hooks up easily.

Verdict: the tool works, but the need never materialized — our APIs are internal, the load is predictable, and no rogue clients roam these parts. Not abandoning it though: the moment an external API appears, I'll take it off the shelf.