.NET 8限流中间件：全局策略生效，端点专属策略失效问题

我在使用.NET 8 Rate Limiting Middleware时，配置了全局限流策略和特定端点的专属策略，全局策略正常运行，但端点专属策略完全不生效。

已配置的代码 #

Startup.cs 中的限流配置 #

private void AddRateLimiter(IServiceCollection services)
{
    logger.Information("Adding Rate Limiter");
    services.AddRateLimiter(options =>
    {
        options.OnRejected = async (context, cancellationToken) =>
        {
            context.HttpContext.Response.StatusCode = 429;

            if (context.Lease.TryGetMetadata(MetadataName.RetryAfter, out var retryAfter))
            {
                await context.HttpContext.Response.WriteAsync(
                    $"Too many requests. Please try again after {retryAfter.TotalMinutes} minute(s). ", cancellationToken);
            }
            else
            {
                await context.HttpContext.Response.WriteAsync(
                    "Too many requests. Please try again later. ", cancellationToken);
            }
        };

        options.AddPolicy("ThrottlePolicy", request =>
        {
            var ipAddress = request.Request.Headers["X-Forwarded-For"].ToString();
            Console.WriteLine($"X-Forwarded-For: {ipAddress}");

            return RateLimitPartition.GetFixedWindowLimiter(ipAddress, partition =>
                new FixedWindowRateLimiterOptions
                {
                    AutoReplenishment = true,
                    PermitLimit = 2,
                    Window = TimeSpan.FromHours(1)
                });
        });


        options.GlobalLimiter = PartitionedRateLimiter.CreateChained(
        PartitionedRateLimiter.Create<HttpContext, string>(request =>
        {
            var ipAddress = request.Request.Headers["X-Forwarded-For"].ToString();
            Console.WriteLine($"X-Forwarded-For (1-minute window): {ipAddress}");

            return RateLimitPartition.GetFixedWindowLimiter(ipAddress, partition =>
                new FixedWindowRateLimiterOptions
                {
                    AutoReplenishment = true,
                    PermitLimit = 300,
                    Window = TimeSpan.FromMinutes(1)
                });
        }),
        PartitionedRateLimiter.Create<HttpContext, string>(request =>
        {
            var ipAddress = request.Request.Headers["X-Forwarded-For"].ToString();
            Console.WriteLine($"X-Forwarded-For (1-hour window): {ipAddress}");

            return RateLimitPartition.GetFixedWindowLimiter(ipAddress, partition =>
                new FixedWindowRateLimiterOptions
                {
                    AutoReplenishment = true,
                    PermitLimit = 3000,
                    Window = TimeSpan.FromHours(1)
                });
        }));
    });
}

控制器端点的特性配置 #

[EnableRateLimiting(policyName: "ThrottlePolicy")]
[Authorize(Policy = "ViewPolicy")]
[HttpPost("{incident_Id}/[controller]")]
[DisableRequestSizeLimit]
[ProducesResponseType(StatusCodes.Status200OK, Type = typeof(FileModel))]
public Task<IActionResult> Post(string incident_Id, [FromForm] FilePostModel evidence)
{
    return HandleRequestAsync(new FileAddRequest()
    {
        IncidentId = incident_Id,
        NewEntity = evidence
    });
}

问题现象 #

控制台日志中能看到全局策略的相关输出，但ThrottlePolicy对应的日志从未出现，专属限流策略完全未生效。

解决方法 #

需要在应用管道中添加路由、授权及端点映射的中间件配置：

app.UseRouting();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
    endpoints.MapControllers();
});

内容的提问来源于stack exchange，提问作者Chris Pressley