--- title: Throttling ASP.NET Web API calls | daily.dev description: Explains how to implement request throttling (rate limiting) in ASP.NET Web API using DelegatingHandler-based message handlers instead of action filters, which... canonical: https://daily.dev/posts/throttling-asp-net-web-api-calls-5e6rfs5al twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Throttling ASP.NET Web API calls | daily.dev og:description: Explains how to implement request throttling (rate limiting) in ASP.NET Web API using DelegatingHandler-based message handlers instead of action filters, which... og:url: https://daily.dev/posts/throttling-asp-net-web-api-calls-5e6rfs5al og:image: https://api.daily.dev/og/posts/5e6RFS5Al.png og:image:alt: Throttling ASP.NET Web API calls og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Throttling ASP.NET Web API calls **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 4 min read · 0 upvotes · 0 comments ## Summary Explains how to implement request throttling (rate limiting) in ASP.NET Web API using DelegatingHandler-based message handlers instead of action filters, which hook in earlier in the pipeline and avoid some authorization-filter quirks. Walks through a custom ThrottlingHandler sample storing request counts in HttpContext.Current.Cache, then introduces the open-source WebApiContrib ThrottlingHandler as a more extensible, scalable alternative supporting custom throttle stores and per-user/IP rate limit logic via an overridable GetUserIdentifier method. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I implement rate limiting in ASP.NET Web API? Use a DelegatingHandler-based message handler registered in config.MessageHandlers rather than an action filter, since message handlers run earlier in the pipeline and avoid having to implement IAuthorizationFilter. A sample handler tracks request counts per client IP in HttpContext.Current.Cache and returns HTTP 409 Conflict once a configured threshold, such as 60 requests per hour, is exceeded. _daily.dev surfaces practical API design patterns like this for developers hardening their own rate limiting._ ### What is the WebApiContrib ThrottlingHandler and how do I configure per-client rate limits? It is a reusable DelegatingHandler from the WebApiContrib project that throttles ASP.NET Web API requests using a pluggable IThrottleStore (an in-memory store ships by default) and a function mapping a client identifier to a request limit per time window. You can give specific IP addresses higher limits, such as 5000 requests per hour for one address versus 60 for everyone else, and override GetUserIdentifier to throttle by username instead of IP. _Developers comparing throttling approaches can keep up with libraries like WebApiContrib via daily.dev._ ## Similar posts on daily.dev - [Rate Limiting in NestJS Using Throttler](https://daily.dev/posts/rate-limiting-in-nestjs-using-throttler-my1m1lqxm) · Telerik · 5 upvotes · 0 comments - [Using request timeouts middleware in web API](https://daily.dev/posts/using-request-timeouts-middleware-in-web-api-ijbjckoyi) · Damir's Corner · 5 upvotes · 1 comments - [ASP.NET Core 11 Request Pipeline Performance Deep Dive](https://daily.dev/posts/asp-net-core-11-request-pipeline-performance-deep-dive-y8dxv0kx8) · C\# Corner · 2 upvotes · 0 comments --- Tags: [#c#](https://daily.dev/tags/c#) [View this post on daily.dev](https://daily.dev/posts/throttling-asp-net-web-api-calls-5e6rfs5al) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Throttling ASP.NET Web API calls","url":"https://daily.dev/posts/throttling-asp-net-web-api-calls-5e6rfs5al","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/throttling-asp-net-web-api-calls-5e6rfs5al"},"datePublished":"2026-10-04T13:05:22.394Z","dateModified":"2026-10-04T13:08:14.146Z","description":"Explains how to implement request throttling (rate limiting) in ASP.NET Web API using DelegatingHandler-based message handlers instead of action filters, which...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/79e66944fd8c21ffeed1940eb03df95c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/79e66944fd8c21ffeed1940eb03df95c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/throttling-asp-net-web-api-calls-5e6rfs5al","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"c#","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"Throttling ASP.NET Web API calls"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/throttling-asp-net-web-api-calls-5e6rfs5al#faq","mainEntity":[{"@type":"Question","name":"How do I implement rate limiting in ASP.NET Web API?","acceptedAnswer":{"@type":"Answer","text":"Use a DelegatingHandler-based message handler registered in config.MessageHandlers rather than an action filter, since message handlers run earlier in the pipeline and avoid having to implement IAuthorizationFilter. A sample handler tracks request counts per client IP in HttpContext.Current.Cache and returns HTTP 409 Conflict once a configured threshold, such as 60 requests per hour, is exceeded. daily.dev surfaces practical API design patterns like this for developers hardening their own rate limiting."}},{"@type":"Question","name":"What is the WebApiContrib ThrottlingHandler and how do I configure per-client rate limits?","acceptedAnswer":{"@type":"Answer","text":"It is a reusable DelegatingHandler from the WebApiContrib project that throttles ASP.NET Web API requests using a pluggable IThrottleStore (an in-memory store ships by default) and a function mapping a client identifier to a request limit per time window. You can give specific IP addresses higher limits, such as 5000 requests per hour for one address versus 60 for everyone else, and override GetUserIdentifier to throttle by username instead of IP. Developers comparing throttling approaches can keep up with libraries like WebApiContrib via daily.dev."}}]} ```