[Breaking change]: ASP.NET Core rate limiting middleware now requires AddRateLimiter

Description

ASP.NET Core rate limiting middleware is being updated in .NET 8 with extra functionality. The middleware now requires services registered with AddRateLimiter.

Version

.NET 8 Preview 5

Previous behavior

Previously, rate limiting could be used without AddRateLimiter. For example, the middleware could be configured by calling Configure<RateLimiterOptions>(o => { }):

var builder = WebApplication.CreateBuilder(args);
builder.Services.Configure<RateLimiterOptions>(o => o
    .AddFixedWindowLimiter(policyName: "fixed", options =>
    {
        // configuration
    }));

var app = builder.Build();
app.UseRateLimiter();
app.MapGet("/", () => Results.Ok($"Hello world")).RequireRateLimiting("fixed");
app.Run();

New behavior

If AddRateLimiter is not called on app startup, then ASP.NET Core will throw an informative error:

Unable to find the required services. Please add all the required services by calling 'IServiceCollection.AddRateLimiter' in the application startup code.

Type of breaking change

[ ] Binary incompatible: Existing binaries may encounter a breaking change in behavior, such as failure to load or execute, and if so, require recompilation.
[ ] Source incompatible: When recompiled using the new SDK or component or to target the new runtime, existing source code may require source changes to compile successfully.
[X] Behavioral change: Existing binaries may behave differently at run time.

Reason for change

Rate limiting middleware requires services that are only registered by calling AddRateLimiter.

Recommended action

Ensure AddRateLimiter() is called at application startup.

For example, update Configure<RateLimiterOptions>(o => { }) to use AddRateLimiter():

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddRateLimiter(o => o
    .AddFixedWindowLimiter(policyName: "fixed", options =>
    {
        // configuration
    }));

var app = builder.Build();
app.UseRateLimiter();
app.MapGet("/", () => Results.Ok($"Hello world")).RequireRateLimiting("fixed");
app.Run();

Affected APIs

UseRateLimiter()

aspnet / Announcements