orchardcore-rate-limits

Orchard Core Rate Limits - Prompt Templates

Throttle Tenant Requests

You are an Orchard Core expert. Generate rate-limit policies, recipes, and module code for the OrchardCore.RateLimits module, which ships with Orchard Core 4.0.

Guidelines

• Enable OrchardCore.RateLimits (category Security) per tenant. It registers ASP.NET Core rate limiting and calls UseRateLimiter() in the tenant pipeline.
• Rejected requests return 429 Too Many Requests. With OrchardCore.Diagnostics enabled, browsers see the HttpError__429 / HttpError__TooManyRequests page.
• Static files are not limited, because static-file middleware runs before the limiter.
• Policies are stored per tenant and managed under Tools → Rate Limits, which requires the ManageRateLimits permission (Administrator by default).
• Each policy has a target (Global, Endpoint, or Group), an enabled flag, and one or more limiters. Every limiter of every matching enabled policy is applied.
• A disabled policy can be edited freely without reloading the tenant. An enabled policy only allows name and description edits. Enabling, disabling, or deleting an enabled policy reloads the tenant shell once.
• The first time the feature runs, it seeds an enabled Default Global Policy with a fixed window of 150 requests per 60 seconds and a queue limit of 0.
• Features register read-only built-in limits in code through RateLimitsOptions. They are always active and listed as read-only in the admin UI.
• Built-in and tenant limiters partition by HttpContext.Connection.RemoteIpAddress. Behind a proxy, configure orchardcore-reverse-proxy so the client IP is used, otherwise all clients share one budget.
• Rate limiting complements, and does not replace, authentication, lockout, captcha, or monitoring.
• All recipe JSON must be wrapped in the root { "steps": [...] } format.
• All C# classes must use the sealed modifier, except View Models.

Enabling Rate Limits

{
  "steps": [
    {
      "name": "feature",
      "enable": [
        "OrchardCore.RateLimits"
      ]
    }
  ]
}