Hello ABP support team,
I'm experiencing a NuGet restore failure on a freshly created project and would like to confirm whether this is a packaging issue on your private feed or something on my side.
Context
I just created a new ABP project to build a POC for an external API integration. Project metadata:
- Template: app
- Created with ABP Studio: 2.2.7
- Current ABP Studio: 2.2.7
- UI Framework: MVC
- Theme: LeptonX (dim, side menu)
- Database Provider: EF Core (SQL Server)
- Tiered: No
- Multi-Tenancy: No
- Public Website: No
- Social Login: Yes
- Include Tests: Yes
- Optional Modules: GDPR, LanguageManagement, AuditLogging, OpenIddictAdmin
Create command used:
abp new POC.ApiSports -t app --ui-framework mvc --database-provider ef --database-management-system sqlserver --theme leptonx --skip-migration --skip-migrator --without-cms-kit --sample-crud-page --dont-run-install-libs --dont-run-bundling --no-multi-tenancy -no-file-management -no-text-template-management
Problem
On the first build, NuGet restore fails repeatedly trying to download Volo.Abp.OperationRateLimiting.Domain version 10.3.0 from the ABP private feed:
No se pudo descargar el paquete "Volo.Abp.OperationRateLimiting.Domain.10.3.0" de
"https://nuget.abp.io/<account-guid>/v3/package/volo.abp.operationratelimiting.domain/10.3.0/volo.abp.operationratelimiting.domain.10.3.0.nupkg".
El código de estado de la respuesta no indica un resultado correcto: 403 (Forbidden).
The error is reproduced on every restore attempt and breaks the build of POC.ApiSports.Application, POC.ApiSports.Application.Tests, POC.ApiSports.Web, POC.ApiSports.EntityFrameworkCore.Tests and POC.ApiSports.Web.Tests. Final result: 10 succeeded, 5 failed.
Other ABP packages restore correctly from the same feed using the same credentials, so the authentication itself appears to be working — the 403 seems specific to this package/version.
What I've checked
- The feed URL is the one configured by ABP Studio at project creation.
- My ABP commercial account is active and other Volo.Abp.* packages download fine.
- No
nuget.configoverrides on my side. - Clearing the local NuGet cache and retrying does not change the result.
Questions
- Is
Volo.Abp.OperationRateLimiting.Domain 10.3.0published and available on the commercial feed for my license tier? - If it is, could you check whether there is a permissions/ACL issue on that specific package on your side?
- If it isn't (e.g. the package was unlisted or the version moved), what is the correct way to align my project — should I downgrade to a previous version, or is there a fix coming?
Full MSBuild output is attached.
Thanks in advance for your help.
Best regards, Aníbal Andrés Díaz Silva
6 Answer(s)
-
0
Volo.Abp.OperationRateLimiting.Domainis a commercial (Pro) module, and it is not available for every commercial license tier. If your license doesn’t include that module, the ABP private feed returns 403 (Forbidden) for that specific package/version, while otherVolo.Abp.*packages may still restore successfully (because they are included in your tier).- For v10.3.x, this module specifically requires ABP Team (or higher). So in your case, the restore error is consistent with a license/module entitlement restriction, not a corrupted project or NuGet client problem.
What to do (pick one):
If you want to use Operation Rate Limiting
- Upgrade to a license tier that includes it (Team or higher).
- Then restore again (the 403 should disappear).
If you don’t need Operation Rate Limiting in this POC
- Remove the dependency chain that brings it in. In your template, it’s commonly pulled indirectly by Account Pro / related pro modules (and possibly by default template wiring).
- Practical steps:
- Search in your solution for any package references like:
Volo.Abp.OperationRateLimiting.*
- Remove those package references and/or remove the module dependency from your
DependsOn(...)chain in your*.WebModule/*.HttpApiHostModule(where it gets brought in).
- Search in your solution for any package references like:
If you believe you should have access but still get 403
- Re-authenticate your ABP credentials/token and try again (sometimes the local token is stale on a new machine/agent):
abp logout abp login dotnet nuget locals all --clear dotnet restoreSources:
- https://abp.io/docs/latest/modules/operation-rate-limiting
- https://abp.io/pricing
- https://abp.io/contact
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
Quick update after trying the AI-Bot suggestions on my side:
abp logout+abp login→ successful re-login asanibaleunder organizationMadrid Digital.dotnet nuget locals all --clear→ cache fully cleared.- Clean + Rebuild → same 403 on
Volo.Abp.OperationRateLimiting.Domain 10.3.0. All other Volo.Abp.* packages restore fine from the same feed with the same credentials.
So a stale token / corrupt cache is ruled out, and this looks consistent with a license/ACL restriction on that specific package on your feed.
To move this forward, I'd appreciate confirmation on two concrete points:
- Does my current commercial license tier include the
Volo.Abp.OperationRateLimitingmodule? - If it does not, why does the default
apptemplate (ABP Studio 2.2.7, v10.3.x) pull it as a dependency? A freshly generated project fromabp new -t appshould compile out of the box on any tier that is allowed to use that template. If this module is Team+ only, the template should either skip it orabp newshould warn at generation time.
From a customer perspective this looks like a template packaging issue rather than an entitlement problem on my account, since I never opted in to Operation Rate Limiting and the project is unbuildable on first restore.
Thanks, Aníbal
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
- Your restore behavior (only that package/version returning 403 while the rest restore fine) matches module entitlement restriction on the commercial feed, not a local NuGet/auth/cache issue.
Volo.Abp.OperationRateLimitingis a Pro module and it requires ABP Team (or higher) to use/download. This is explicitly stated in ABP’s Operation Rate Limiting documentation, and it also notes that the module is used by Account (Pro) modules and can come pre-installed in the latest startup templates.
So for your two concrete questions:
Does your current license tier include
Volo.Abp.OperationRateLimiting?
I can’t see your license tier from here, but the rule is definitive: only Team (or higher) includes it. If you’re on a lower tier, you will get 403 exactly like this when restoringVolo.Abp.OperationRateLimiting.Domain(10.3.0 included).Why does the default
apptemplate pull it?
Because in v10.3 the module is used internally by Account (Pro) modules and is also described as pre-installed in the latest startup templates. If your template selection (e.g., Social Login / OpenIddictAdmin / other Pro account-related features) caused Account Pro packages/modules to be included, they can bringOperationRateLimitingas a dependency—then restore fails on tiers that don’t include it. Practically, this means the generated solution can become “unbuildable out of the box” unless the generator filters Pro-only modules based on license, which appears to be the gap you’re hitting.
Workarounds you can apply immediately (to make the solution build without upgrading):
- Remove the Pro dependency that pulls
OperationRateLimiting:- In your
*.csprojfiles, remove anyPackageReferencetoVolo.Abp.OperationRateLimiting.*(if present). - Also check your
DependsOn(...)chain in yourPOC.ApiSports*.Moduleclasses and remove any module dependency related to OperationRateLimiting (directly) and/or the specific Pro module that introduced it (often via Account Pro features).
- In your
- Regenerate the solution without the feature set that brings Account Pro dependencies (e.g., avoid selecting options that require Pro modules), if possible for the POC.
If you want this treated as a template/generation issue (so ABP Studio/CLI warns or excludes it based on license), please report it through the official channel so the team can reproduce it against your exact template options and license entitlement:
- https://abp.io/contact
(Links validated.)
Sources:
- https://abp.io/docs/latest/modules/operation-rate-limiting
- https://abp.io/pricing
- https://abp.io/contact
This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
Thanks for the AI-Bot follow-up. It actually confirms the diagnosis from my side, but it leaves the two questions I asked unanswered, so I'd like to escalate this to a human support engineer within this same ticket rather than opening a new channel.
What the AI-Bot already acknowledges:
- The 403 behavior is consistent with module entitlement restriction on the commercial feed, not a local issue.
Volo.Abp.OperationRateLimitingis pulled by Account (Pro) modules and is described as pre-installed in the latest startup templates.- Quoting the bot directly: "the generated solution can become 'unbuildable out of the box' unless the generator filters Pro-only modules based on license, which appears to be the gap you're hitting."
That last sentence is the core of the problem. A paying customer running
abp new -t appwith ABP Studio 2.2.7 should not get a project that fails to restore on first build. Either the template should filter Pro modules according to the license tier, orabp newshould warn at generation time.What I still need from a human engineer:
- License confirmation. Does my current tier (organization
Madrid Digital, useranibale) includeVolo.Abp.OperationRateLimiting? The AI-Bot explicitly said it cannot see this; only your team can. - Template behavior. If my tier does not include it, this is a template generation bug, not a customer-side workaround issue. I'd like the team to track it as such. Suggesting that I manually strip
PackageReferenceentries and editDependsOn(...)chains in a freshly generated solution is not an acceptable workaround for a commercial product — it would also leave the project diverging from the official template, with unclear runtime impact. - Path forward. Either confirm the tier upgrade needed (with the exact module name and minimum tier) so it can be evaluated internally, or provide an official fix / regeneration option that produces a buildable solution on my current tier.
I'd rather not open a parallel report at
abp.io/contactas the bot suggested — the information is already here and duplicating it across channels only adds friction. Could a human engineer pick this up?Thanks, Aníbal
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
Hi Aníbal,
Thanks for the detailed report. You're right that this looks like a license/module entitlement issue on our side rather than something for you to work around in the generated project.
We'll check and adjust the Personal license entitlement for the
Volo.Abp.OperationRateLimiting.*packages on our end. I'll get back to you on this thread once it's done.Thanks,
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
Hi Aníbal,
Quick update — we've granted access to the
Volo.Abp.OperationRateLimiting.*packages for the Personal license on our side. Could you give it another try?dotnet nuget locals all --clear dotnet restoreThe 403 should be gone now. Let me know if it still fails on your side.
Thanks,
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)