Why Your .NET Rate Limiter Fails at Scale (And How to Fix It)

In-memory rate limiting breaks when scaling .NET APIs to multiple instances. This tutorial demonstrates how to implement distributed rate limiting using Redis as a shared store. It covers two algorithms: a fixed window rate limiter using Redis counters with TTL, and a sliding window rate limiter using Redis sorted sets to track request timestamps. The implementation uses StackExchange.Redis with .NET 10, wired up as ASP.NET middleware returning 429 responses with Retry-After headers. A note is made that both implementations lack atomicity in high-concurrency scenarios, with Lua scripting suggested as the solution.