Epic: Rate Limiting

[BrennanConroy]

This issue captures issues related to rate limiting work in .NET 9. Issues and categorizations are subject to change as design and planning is underway.

• Distributed rate limiting
  • Redis Implementation
  • Any new primitives needed?
• More Configuration
  • Changing config at runtime
  • IConfiguration support?
• Missing features
  • Weighted endpoints (e.g. POST /buyItem costs 2 instead of 1 for GET /listItems)
  • Circuit breaker? (X request failures/sec, fail incoming requests to allow service time to self-heal)
• Metrics
  • Any additional metrics needed?
  • At a minimum document how to do manual metric retrieval

[aKzenT]

What is missing from this list is the support of multiple rate limits per endpoint (as requested in #42691 ). E.g. you want to allow your order endpoint to accept a maximum of five orders per IP per minute, but also a maximum of 100 orders per day.

[ShaneCourtrille]

@BrennanConroy One scenario we've run into is the need for rate limiting for the first 3 minutes of startup after which we can safely switch to no limiter. Is switching the rate limiter based on config going to be possible? Or would we just be using the concurrency limiter and changing the permit limit?

[BrennanConroy]

Unfortunately, the majority of this work is being pushed back to .NET 10.

[jakubsemerak]

Also priority queues used inside rate limiters would be pretty nice. In our case we needed to skip the queue line by priority communication to minimize response time as much as possible. So we have replaced standard Queue with PriorityQueue and everything works flawlessly. IMO priority queue inside the limiters would be more universal.

[adityamandaleeka]

Re-titled the issue and moved it to the backlog for now until we find time to work on this area again.