Document: https://github.com/abpframework/abp/blob/dev/docs/en/framework/infrastructure/operation-rate-limiting.md

Resolve #17815

Demo UI: #25025

Adds the Volo.Abp.OperationRateLimiting package — a web-agnostic, application-level rate limiting module for ABP Framework.

Unlike ASP.NET Core's built-in HTTP rate limiting middleware (which operates at the request pipeline level), this module is designed to be called explicitly from application service methods, domain logic, or anywhere in the DI container. It is not tied to HTTP and has no dependency on HttpContext.

Getting started

Add a dependency on AbpOperationRateLimitingModule and define policies in ConfigureServices:

[DependsOn(typeof(AbpOperationRateLimitingModule))]
public class MyModule : AbpModule
{
    public override void ConfigureServices(ServiceConfigurationContext context)
    {
        Configure<AbpOperationRateLimitingOptions>(options =>
        {
            options.AddPolicy("SendSmsCode", policy =>
            {
                policy.WithFixedWindow(TimeSpan.FromMinutes(1), maxCount: 3)
                      .PartitionByParameter();
            });
        });
    }
}

Then inject IOperationRateLimitingChecker and call CheckAsync in your application service. If the limit is exceeded it throws AbpOperationRateLimitingException (mapped to HTTP 429):

public class SmsAppService : ApplicationService
{
    private readonly IOperationRateLimitingChecker _checker;

    public SmsAppService(IOperationRateLimitingChecker checker)
    {
        _checker = checker;
    }

    public async Task SendCodeAsync(string phoneNumber)
    {
        await _checker.CheckAsync("SendSmsCode", phoneNumber);

        // proceed with sending SMS...
    }
}

Extension methods are provided for all four checker methods (CheckAsync, IsAllowedAsync, GetStatusAsync, ResetAsync) so you can pass a parameter string directly without constructing OperationRateLimitingContext manually.

Partition types

PartitionByCurrentUser, PartitionByCurrentTenant, and PartitionByClientIp resolve exclusively from their respective services and do not fall back to context.Parameter. This avoids partition key conflicts in composite policies where Parameter is shared across all rules. If you need to check rate limits for a specific user, tenant, or IP explicitly, use PartitionByParameter() instead:

// Admin checking another user's rate limit
await checker.CheckAsync("UserApiLimit",
    new OperationRateLimitingContext { Parameter = targetUserId.ToString() });

Composite rules

A policy can have multiple rules (AddRule()). All rules are checked in a two-phase flow: Phase 1 reads current counts without incrementing; Phase 2 increments only after all rules pass. This prevents wasted quota on requests that would be blocked by a later rule.

options.AddPolicy("LoginAttempt", policy =>
{
    // per-IP burst limit (short window)
    policy.AddRule(rule => rule
        .WithFixedWindow(TimeSpan.FromMinutes(1), maxCount: 10)
        .PartitionByClientIp());

    // per-user daily limit (long window)
    policy.AddRule(rule => rule
        .WithFixedWindow(TimeSpan.FromHours(24), maxCount: 50)
        .PartitionByCurrentUser());
});

Multi-tenancy

All partition types default to a global counter (shared across tenants). Call .WithMultiTenancy() on a rule to opt into per-tenant counter isolation:

// global — all tenants share the same counter
policy.WithFixedWindow(TimeSpan.FromHours(1), maxCount: 100)
      .PartitionByParameter();

// isolated — each tenant has its own counter for the same parameter
policy.WithFixedWindow(TimeSpan.FromHours(1), maxCount: 100)
      .WithMultiTenancy()
      .PartitionByParameter();

Client IP resolution

PartitionByClientIp() resolves the client IP address via the existing IWebClientInfoProvider abstraction from Volo.Abp.AspNetCore.Abstractions. In ASP.NET Core environments, HttpContextWebClientInfoProvider reads from HttpContext.Connection.RemoteIpAddress. In non-web scenarios, the default NullWebClientInfoProvider returns null, and using PartitionByClientIp() will throw an AbpException. Use PartitionByParameter() to pass the IP explicitly in non-web contexts.

Error response

On limit exceeded, throws AbpOperationRateLimitingException which is serialized to a standard ABP error response with data containing RetryAfter, RetryAfterSeconds, WindowDescription, CurrentCount, MaxCount, and RemainingCount.