RateLimiter.IISModule 1.0.2

IIS Rate Limiter Module

A custom IIS HTTP Module for subsystem-wise and API-wise rate limiting. Perfect for APIs that use custom authentication headers to identify clients/subsystems.

Features

• Per-endpoint rate limiting - Different limits for different URLs
• URL pattern matching - Wildcards support (* for segment, ** for any path)
• HTTP method filtering - Different limits for GET vs POST
• Client identification - IP address, API keys, custom headers
• Request data analysis - Include query parameters and headers in rate limit key
• JSON body parsing - Extract fields from request body for rate limiting
• Sliding window algorithm - Smooth rate limiting without sharp resets
• Configurable via JSON - Easy configuration without code changes

Installation

1. Build the Module

cd RateLimiter.IISModule
dotnet build -c Release

2. Deploy to Your Web Application

Copy the built DLL to your application's bin folder:

copy .\bin\Release\net48\RateLimiter.IISModule.dll C:\inetpub\wwwroot\YourApp\bin\
copy .\bin\Release\net48\Newtonsoft.Json.dll C:\inetpub\wwwroot\YourApp\bin\

3. Register the Module in web.config

Add to your application's web.config:

<configuration>
  <system.webServer>
    <modules>
      <add name="RateLimitingModule" 
           type="RateLimiter.IISModule.RateLimitingModule, RateLimiter.IISModule" 
           preCondition="managedHandler" />
    </modules>
  </system.webServer>
</configuration>

4. Configure Rate Limits

Create App_Data\ratelimit.config.json in your web application:

{
  "includeUrlInKey": true,
  "includeMethodInKey": true,
  "clientIdHeader": "X-API-Key",
  
  "defaultRule": {
    "name": "Default",
    "maxRequests": 100,
    "windowSeconds": 60
  },
  
  "rules": [
    {
      "name": "Login",
      "urlPattern": "/api/auth/login",
      "methods": ["POST"],
      "maxRequests": 5,
      "windowSeconds": 60,
      "priority": 100
    }
  ]
}

Configuration Options

Global Settings

Rate Limit Rules

URL Pattern Examples

Response Headers

When rate limited, the module returns:

• Status Code: 429 Too Many Requests
• Retry-After: Seconds until the window resets
• X-RateLimit-Limit: Maximum requests allowed
• X-RateLimit-Window: Time window duration

Advanced Usage

Rate Limiting by Request Body Content

For advanced scenarios like rate limiting by user ID in the request body, you can extend the module to use RequestBodyAnalyzer:

// Extract fields from JSON body
var fields = RequestBodyAnalyzer.ExtractJsonFields(request, new[] { "userId", "action" });

// Include in rate limit key
foreach (var field in fields)
{
    keyParts.Add($"{field.Key}={field.Value}");
}

Combining with IIS Dynamic IP Restrictions

For defense in depth, combine this module with IIS's built-in IP restrictions:

<security>
  <dynamicIpSecurity denyAction="Forbidden">
    <denyByConcurrentRequests enabled="true" maxConcurrentRequests="20" />
    <denyByRequestRate enabled="true" maxRequests="100" requestIntervalInMilliseconds="1000" />
  </dynamicIpSecurity>
</security>

Troubleshooting

Module Not Loading

1. Ensure .NET Framework 4.8 is installed
2. Check Application Pool is using .NET 4.0 CLR
3. Verify DLLs are in the bin folder

Rate Limits Not Applied

1. Check the module is registered in web.config
2. Verify ratelimit.config.json is in App_Data folder
3. Check URL patterns match your endpoints

Performance Considerations

• The module uses in-memory storage (fast but not distributed)
• For web farm scenarios, consider Redis-based implementation
• Cleanup runs every minute to prevent memory leaks

License

MIT License