Using ASP.Net Core 8, we're create a rate limiting policy with the FixedWindowRateLimiter using IP address as a partition key. This allows us to limit the number of requests for each IP address.
X-Forwarded-For can be important depending on the server setup and if it uses a proxy, so we consider how to still get the IP address if a proxy is in use.
https://github.com/gavjl/ASP.Net-Core...
Secure Coding in ASP.NET Core Course: https://devsecforge.com/l/ps-aspnet
Checkout my Pluralsight courses on software dev / security: https://link.devsecforge.com/ps-auth