Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/nimanikoo/Dotnet-RateLimiter/llms.txt

Use this file to discover all available pages before exploring further.

RedisRateLimitAttribute is a lightweight marker that you place on any controller action (or minimal-API endpoint) to opt it into distributed Redis rate limiting. It carries two values — a request ceiling and a window duration — which RedisRateLimitingMiddleware reads at runtime from the endpoint’s metadata collection. Endpoints that do not carry this attribute are skipped entirely by the middleware, so you have precise, per-route control over which paths are protected.

​
Namespace

namespace Dotnet_RateLimiter.Attributes;

​
Class Declaration

public class RedisRateLimitAttribute : Attribute
Inherits directly from System.Attribute. No additional base classes or interfaces are involved.

​
Constructor

public RedisRateLimitAttribute(int maxRequests, int windowSeconds)
Both parameters are required positional arguments. They are stored in read-only properties and cannot be changed after construction.
ParameterTypeDescription
maxRequestsintMaximum number of requests allowed within the window.
windowSecondsintLength of the rate-limit window in seconds.

​
Properties

​
MaxRequests
int
required
The maximum number of requests a single client is permitted to make to the decorated endpoint within one window. The middleware passes this value directly to RedisRateLimiter.IsAllowedAsync as maxRequests.
​
WindowSeconds
int
required
The length of the rate-limit window expressed in seconds. The middleware converts this to a TimeSpan via TimeSpan.FromSeconds(rateLimitAttr.WindowSeconds) before passing it to RedisRateLimiter.IsAllowedAsync. It is also written verbatim into the Retry-After response header when a 429 is returned.

​
Full Source

namespace Dotnet_RateLimiter.Attributes;

public class RedisRateLimitAttribute : Attribute
{
    public int MaxRequests { get; }
    public int WindowSeconds { get; }

    public RedisRateLimitAttribute(int maxRequests, int windowSeconds)
    {
        MaxRequests = maxRequests;
        WindowSeconds = windowSeconds;
    }
}

​
Usage on a Controller Action

Decorate any controller action with [RedisRateLimit(maxRequests, windowSeconds)]: 
using Dotnet_RateLimiter.Attributes;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Route("[controller]")]
public class WeatherForecastController : ControllerBase
{
    // Allow a maximum of 5 requests per 10-second window per client
    [HttpGet]
    [RedisRateLimit(maxRequests: 5, windowSeconds: 10)]
    public IActionResult GetForecast()
    {
        // ...
        return Ok();
    }

    // A more generous limit for a read-heavy search endpoint
    [HttpGet("search")]
    [RedisRateLimit(maxRequests: 30, windowSeconds: 60)]
    public IActionResult Search([FromQuery] string query)
    {
        // ...
        return Ok();
    }
}

​
How the Middleware Reads This Attribute

RedisRateLimitingMiddleware retrieves the attribute from the current endpoint’s metadata on every request: 
var endpoint = context.GetEndpoint();
var rateLimitAttr = endpoint.Metadata.GetMetadata<RedisRateLimitAttribute>();

if (rateLimitAttr == null)
{
    // No attribute present — skip rate limiting for this endpoint
    await _next(context);
    return;
}
ASP.NET Core automatically populates IEndpointMetadataCollection with all attributes declared on a matched action, so GetMetadata<T>() returns the attribute instance when present and null otherwise.
[RedisRateLimit] works exclusively with RedisRateLimitingMiddleware. It does not integrate with ASP.NET Core’s built-in [EnableRateLimiting] mechanism or the IRateLimiterPolicy pipeline registered via services.AddRateLimiter(...). The two systems are independent — you can use both on the same application without conflict.

Build docs developers (and LLMs) love

Get started for freeTalk to us