[Breaking change]: Obsolete ConcurrencyLimiterMiddleware

[mitchdenny]

Description

In .NET 8.0 the ASP.NET Core team is deprecating the ConcurrencyLimiterMiddleware and associated methods and types (e.g. UseConcurrencyLimiter(...)). This package will be removed in .NET 9.0.

Developers requiring rate limiting capabilties should switch to the newer and more capable rate limiting middleware that was introduced in .NET 7.0 (e.g. UseRateLimiter(...)). The .NET 7.0 rate limiting API includes a concurrency limiter along with several other rate limiting algorithms that you can apply to your application.

For more information on rate limiting in ASP.NET Core see:
https://learn.microsoft.com/aspnet/core/performance/rate-limit

Version

.NET 8 Preview 4

Previous behavior

Developers using the ConcurrencyLimiterMiddleware could control concurrency by adding a policy to DI and enabling the middleware:

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddStackPolicy<options => {
    options.MaxConcurrentRequests = 2;
    options.RequestQueueLimit = 25;
    });

var app = builder.Build();
app.UseConcurrencyLimiter();
// Map endpoints.
app.Run();

New behavior

Here is some example usage using the new API:

using Microsoft.AspNetCore.RateLimiting;
using System.Threading.RateLimiting;

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

app.UseRateLimiter(new RateLimiterOptions()
    .AddConcurrencyLimiter("only-one-at-a-time-stacked", (options) =>
    {
        options.PermitLimit = 2;
        options.QueueLimit = 25;
        options.QueueProcessingOrder = QueueProcessingOrder.NewestFirst;
    }));

app.MapGet("/", async () =>
{
    await Task.Delay(10000);
    return "Hello World";
}).RequireRateLimiting("only-one-at-a-time-stacked");

app.Run();

Type of breaking change

• Binary incompatible: Existing binaries may encounter a breaking change in behavior, such as failure to load or execute, and if so, require recompilation.
• Source incompatible: When recompiled using the new SDK or component or to target the new runtime, existing source code may require source changes to compile successfully.
• Behavioral change: Existing binaries may behave differently at run time.

Reason for change

The older ConcurrencyLimiterMiddleware is infrequently used and undocumented. The newer rate limiting API has more extensive functionality.

Recommended action

If you are using the older ConcurrencyLimiterMiddleware we recommend moving to the newer rate limiting middleware.

Affected APIs

The following APIs are impacted:

• ConcurrencyLimiterExtensions.UseConcurrencyLimiter(...)
• ConcurrencyLimiterMiddleware
• ConcurrencyLimiterOptions