With MvcThrottle you can protect your site from aggressive
crawlers, scraping tools or unwanted traffic spikes originated from the same
location by limiting the rate of requests that a client from the same IP can
make to your site or to specific routes. MvcThrottle is compatible with ASP.NET
MVC 5.1 and can be installed via NuGet, the package is available at nuget.org/packages/MvcThrottle.
You can set multiple limits
for different scenarios like allowing an IP to make a maximum number of calls
per second, per minute, per hour or per day. You can define these limits to
address all requests made to your website or you can scope the limits to each
Controller, Action or URL, with or without query string params.
MvcThrottle filter is
designed for controlling the rate of requests that clients can make to a
website based on IP address, request route and client identity. You can set
multiple limits for different scenarios like allowing an IP to make a maximum
number of calls per second, per minute, per hour or per day. You can define
these limits to address all requests made to your website or you can scope the
limits to each Controller, Action or URL, with or without query string params.
Global throttling based
on IP
The setup bellow will limit the number of
requests originated from the same IP.
If from the same IP, in same second, you’ll make a call to home/index and home/about the last call will get blocked.
If from the same IP, in same second, you’ll make a call to home/index and home/about the last call will get blocked.
public class FilterConfig
{
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
var throttleFilter = new ThrottlingFilter
{
Policy = new ThrottlePolicy(perSecond: 1, perMinute: 6, perHour: 9, perDay: 90)
{
IpThrottling = true
},
Repository = new CacheRepository()
};
filters.Add(throttleFilter);
}
}
In order to enable throttling you’ll have to
decorate your Controller or Action withEnableThrottlingAttribute, if
you want to exclude a certain Action you can applyDisableThrottingAttribute.
[EnableThrottling]
public class HomeController : Controller
{
public ActionResult Index()
{
return View();
}
[DisableThrotting]
public ActionResult About()
{
return View();
}
}
You can define custom limits using the EnableThrottling
attribute, these limits will override the default ones.
[EnableThrottling(PerSecond = 2, PerMinute = 10, PerHour = 30)]
public ActionResult Index()
{
return View();
}
Endpoint throttling based
on IP
If, from the same IP, in the same second,
you’ll make two calls to home/index, the last call will get blocked.
But if in the same second you call home/about too, the request will go through because it’s a different route.
But if in the same second you call home/about too, the request will go through because it’s a different route.
var throttleFilter = new ThrottlingFilter
{
Policy = new ThrottlePolicy(perSecond: 1, perMinute: 10, perHour: 60)
{
IpThrottling = true,
EndpointThrottling = true,
EndpointType = EndpointThrottlingType.ControllerAndAction
},
Repository = new CacheRepository()
};
