Delay ASP.NET response without blocking worker thread for the duration
<p>So I've been reading around the area of throttling login requests from an IP address or against a user by using exponentially increasing delays. This is an artificial delay where the server won't response, effectively sitting on the response. So far I've found little in the way of a good implementation of this delay.</p>

<p>My options are:</p>

<p>Thread.Sleep() - It works but a DDOS attack will easily eat all the available worker threads in ASP.NET</p>

<p>or</p>

<p>Return something like a 429 (Too Many Requests) until the delay has expired.</p>

<p>So two different approaches where one replies immediately and gives the work to the client to try again or one where the server will sit on the request and delay the response.</p>

<p>I would ideally like to go with the latter where I have the server delay the response. I've tried a HttpAsyncHandler as per this answer: <a href="http://stackoverflow.com/a/1614625">http://stackoverflow.com/a/1614625</a></p>

<p>I've got the Thread.Sleep happening in the HttpAsyncHandler but the problem is the response has already gone back to the client. The answer says that I should block for the WaitHandle before I let the response go back, but I don't know how to do this and from what I can see, I would still be blocking the worker thread from handling another request in the meantime surely. </p>

<p>It's as if I need worker threads to pickup both new requests and pickup delayed ones to issue a response. Is this possible to do in ASP.NET Web Forms? the MVC AsyncController looks perfect for what I need but I can't use that in this instance.</p>
