Rate limiting middleware not working with app.UseRouting()

[anuraj]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Recently I migrated a .NET 6.0 Web API to .NET 7.0 - in the .NET 6.0 code, there was an app.UseRouting() method. When I integrated the Fixed Window Rate Limiting implementation. Rate Limiting was not working. I can keep sending requests it always returns the data. If I remove the app.UseRouting() the Rate Limiting starts working.

Expected Behavior

Rate Limiter should work based on the configuration - after the configured requests - the API should return an error response status code instead of success.

Steps To Reproduce

Here is the repo with integration tests - https://github.com/anuraj/Weatherforecast

Steps.

1. Create a web API with the minimal API template. Use following code in the Program.cs

using System.Threading.RateLimiting;
using Microsoft.AspNetCore.RateLimiting;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRateLimiter(_ => _
    .AddFixedWindowLimiter(policyName: "fixed", options =>
    {
        options.PermitLimit = 4;
        options.Window = TimeSpan.FromSeconds(12);
        options.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
        options.QueueLimit = 0;
    }));

builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();
app.UseRateLimiter();
// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

var summaries = new[]
{
    "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
};

app.MapGet("/weatherforecast", () =>
{
    var forecast =  Enumerable.Range(1, 5).Select(index =>
        new WeatherForecast
        (
            DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
            Random.Shared.Next(-20, 55),
            summaries[Random.Shared.Next(summaries.Length)]
        ))
        .ToArray();
    return forecast;
})
.WithName("GetWeatherForecast").RequireRateLimiting("fixed")
.WithOpenApi();

app.UseRouting();

app.Run();

record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
{
    public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
}

public partial class Program { }

2. Next run the application. Navigate to /weatherforecast endpoint.
3. Keep refreshing - Since the rate limit is enabled, in an ideal scenario after 4 requests it should fail. But it won't. You will be able to see the JSON results always.

Exceptions (if any)

No

.NET Version

7.0.100

Anything else?

No response

[Kahbazi]

@anuraj The problem is with the middleware order. You need to have app.UseRateLimiter() after app.UseRouting().

[anuraj]

@Kahbazi Thank you. That was the issue. But in that case, I think it should mention somewhere in the rate-limiting middleware documentation. I don't think it was mentioned anywhere. In the documentation, it is after the var app = builder.Build(); statement, so kept it like that. Thanks for the update.