How to configure global rate limiting in ocelot.json file?

[perisicnikola37]

How to enable global rate limiting on all defined endpoints without repeating the definitions at the end of each endpoint?

This doesn't work:

{
  "Routes": [
    {
      "DownstreamPathTemplate": "/api/accounts",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "account_api",
          "Port": "8080"
        }
      ],
      "UpstreamPathTemplate": "/accounts",
      "UpstreamHttpMethod": ["POST"]
    },
  ],
  "GlobalConfiguration": {
    "BaseUrl": "http://localhost:8010",
    "RateLimitOptions": {
      "ClientWhitelist": [],
      "EnableRateLimiting": true,
      "Period": "10s",
      "PeriodTimespan": 10,
      "Limit": 5
    }
  }
}

[raman-m]

Hello, Nikola! And welcome to the world of Ocelot! 🐯

You are not alone, and such a question regarding global Rate Limiting options was asked by other developers:

• Global rate limiting for all, multiple routes instead of every route #1229
• Apply rate limiting globally  #1915 (comment)
• Support Global configuration of load balancer and rate limiting options etc for ReRoutes #585 (comment)
  This discussion clarifies why the feature has not been implemented yet, as applying the same rate limiting to all static routes is considered poor DevOps practice.

To set up dynamic routing and apply global settings, consider reading the following documentation:

• Rate Limiting | Global Configuration
• Dynamic Routing: So, global rate limiting opts are available in dynamic routing mode. You have to setup service discovery: Consul, K8s, Eureka etc.

[raman-m]

Documentation was updated in release 23.3.5. Here is the updated Rate Limiting | Global Configuration docs.

[perisicnikola37]

Thank you

[perisicnikola37]

@raman-m Hi. Is this feature available now?

[raman-m]

@perisicnikola37 No! Unfortunately, I'm swamped with the .NET 9 release. Our team capacity is currently limited as other members are not actively working. Please reach out to me again after the release, as prioritization can only be addressed post the .NET 9 version.

[raman-m]

One question: Do you actually use header-based limiting, also known as Rate Limit by Client's Header? This feature in Ocelot is poorly designed and has flaws. Have you considered the ASP.NET Implementation, which is a native Microsoft feature?