Implementing API Rate Limiting with Redis in Admin.Core
This article introduces the configuration and principles of implementing IP rate limiting in the ZhonTai Admin.Core framework based on AspNetCoreRateLimit and Redis. First, rate limiting must be enabled in `appconfig.json` and `cacheconfig.json`, with Redis specified as the storage backend to support multi-instance distributed environments. Rate limiting rules are defined in `appsettings.json`, supporting differentiated strategies for global endpoints and specific interfaces (such as login). Key configurations include enabling endpoint rate limiting, avoiding request stacking, and correctly setting the real IP header. The working principle involves the middleware generating Redis keys based on IP and path for counting; if the limit is exceeded, a 429 status code is returned, and the frontend prompts the user. The article specifically points out that the middleware registration order must place `UseIpRateLimiting` after `UseStaticFiles` to prevent static file requests from triggering rate limiting. Additionally, the article provides steps for manually integrating this component in environments other than Admin.Core, and mentions the built-in rate limiting mechanism in .NET 7 as an alternative solution, recommending that developers already using this framework directly leverage the built-in features to simplify development.