rate-limiting

ChainedPartitionedRateLimiter walks each limiter once, but the ASP.NET Core rate limiting middleware calls the chain twice when the first pass fails: AttemptAcquire, then AcquireAsync. With fixed window or token bucket limiters a rejected request burns two permits from the first limiter, and a queued request does too. Reproduced on ASP.NET Core 10.0.10 and 11.0 RC3, with a wrapper that makes the middleware walk the chain once.

A complete guide to per-endpoint rate limiting in ASP.NET Core 11: when to pick fixed window vs sliding window vs token bucket vs concurrency, how RequireRateLimiting and [EnableRateLimiting] differ, partitioning by user or IP, the OnRejected handler, and the distributed deployment pitfall everyone hits.