limit_req_zone and limit_req in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the effect of this limit_req_zone directive?

Given the configuration snippet:

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r/s;

What does this directive do in NGINX?

Nginx

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r/s;

A It allows unlimited requests but logs client IPs in a 10MB zone named 'mylimit'.

B It limits total server requests to 5 per second, using 10MB memory for buffering.

C It blocks any client IP that sends more than 5 requests in total, using 10MB disk space.

D It limits requests to 5 requests per second per unique client IP, storing state in a 10MB shared memory zone named 'mylimit'.

💡 Hint

Think about what $binary_remote_addr and rate=5r/s mean in this context.

The limit_req_zone directive defines a shared memory zone to track request rates per key. Here, $binary_remote_addr means the client IP is used as the key. The zone named 'mylimit' uses 10MB memory to store states. The rate=5r/s limits each client IP to 5 requests per second.

💻 Command Output

intermediate

What happens when this limit_req is applied?

Given this snippet inside a server block:

limit_req zone=mylimit burst=10 nodelay;

What is the behavior of NGINX when requests exceed the rate defined in the zone?

Nginx

limit_req zone=mylimit burst=10 nodelay;

A NGINX queues requests indefinitely until the rate drops below the limit.

B NGINX allows up to 10 extra requests to queue immediately without delay, then rejects further requests with 503 error.

C NGINX rejects any request exceeding the rate immediately without queuing.

D NGINX delays all requests by 10 seconds before processing them.

💡 Hint

Consider what 'burst' and 'nodelay' mean for request handling.

The burst=10 allows up to 10 requests to exceed the rate limit temporarily by queuing them. The nodelay option means these burst requests are processed immediately without delay. Requests beyond this burst are rejected with a 503 error.

❓ Troubleshoot

advanced

Why does this NGINX config cause a syntax error?

Identify the cause of the syntax error in this configuration:

limit_req_zone $remote_addr zone=one:10m rate=1r/s
limit_req zone=one burst=5;

Nginx

limit_req_zone $remote_addr zone=one:10m rate=1r/s;
limit_req zone=one burst=5;

A Missing semicolon at the end of the first line causes syntax error.

B Using $remote_addr instead of $binary_remote_addr is invalid in limit_req_zone.

C The zone name 'one' is too short and invalid.

D The burst parameter cannot be used without nodelay.

💡 Hint

Check punctuation at the end of each directive line.

NGINX requires each directive to end with a semicolon. The first line is missing a semicolon, causing a syntax error.

✅ Best Practice

advanced

Which is the best way to avoid blocking legitimate users with limit_req?

You want to limit request rates but avoid blocking users who occasionally send bursts of requests. Which configuration is best?

A Use limit_req with a burst value and no nodelay to allow queued requests to be delayed.

B Use limit_req_zone with a very low rate and no burst to strictly block excess.

C Use limit_req with burst=0 to reject all excess requests immediately.

D Disable limit_req and rely on firewall rules instead.

💡 Hint

Think about how burst and nodelay affect request queuing and delays.

Setting a burst with no nodelay queues excess requests and delays them instead of rejecting immediately. This helps avoid blocking users who send occasional bursts.

🔀 Workflow

expert

Order the steps to configure rate limiting with limit_req_zone and limit_req

Put these steps in the correct order to implement rate limiting in NGINX using limit_req_zone and limit_req.

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 2,3,1,4

💡 Hint

Think about defining the zone before using it, then applying and testing.

First, define the shared memory zone with limit_req_zone. Then apply limit_req in server or location block. Reload NGINX to apply changes. Finally, test the setup.

Practice

1. What is the main purpose of the limit_req_zone directive in nginx?

easy

A. To log requests that exceed the limit

B. To apply the rate limit rules to a specific location

C. To define the key and rate limit parameters for request limiting

D. To restart nginx when limits are reached

Solution

1. Step 1: Understand the role of limit_req_zone

   This directive sets the shared memory zone and key used to track requests for limiting.

2. Step 2: Differentiate from limit_req

   limit_req applies the rules, but limit_req_zone defines them.

3. Final Answer:

   To define the key and rate limit parameters for request limiting -> Option C

4. Quick Check:

   limit_req_zone defines limits [OK]

Hint: Remember: zone defines limits, limit_req applies them [OK]

Common Mistakes:

• Confusing limit_req_zone with limit_req
• Thinking it applies limits directly
• Assuming it logs requests

2. Which of the following is the correct syntax to define a rate limit zone named mylimit with 10MB memory and 5 requests per second per IP?

easy

A. limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r/s;

B. limit_req_zone zone=mylimit:10m $binary_remote_addr rate=5r/s;

C. limit_req_zone $remote_addr zone=mylimit:5m rate=10r/s;

D. limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r/m;

Solution

1. Step 1: Check the correct order of parameters

   The syntax is limit_req_zone key zone=name:size rate=rate; so key first, then zone with name and size, then rate.

2. Step 2: Validate values

   $binary_remote_addr is preferred key, zone name is mylimit, size is 10m, rate is 5r/s (requests per second).

3. Final Answer:

   limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r/s; -> Option A

4. Quick Check:

   Correct syntax = limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r/s; [OK]

Hint: Syntax: key zone=name:size rate=numberr/s [OK]

Common Mistakes:

• Swapping zone and key order
• Using wrong memory size units
• Confusing rate units (r/s vs r/m)

3. Given this nginx config snippet:

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
server {
  location /api/ {
    limit_req zone=one burst=2;
  }
}

What happens if a client sends 4 requests instantly to /api/?

medium

A. All 4 requests are processed immediately

B. 1 request processed immediately, 2 delayed, 1 rejected

C. 1 request processed immediately, 3 rejected

D. All 4 requests rejected

Solution

1. Step 1: Understand rate and burst

   Rate is 1 request per second, burst=2 allows 2 extra requests to queue.

2. Step 2: Analyze 4 instant requests

   First request passes immediately, next 2 are delayed (burst), 4th exceeds burst and is rejected.

3. Final Answer:

   1 request processed immediately, 2 delayed, 1 rejected -> Option B

4. Quick Check:

   burst=2 allows 2 queued requests [OK]

Hint: burst allows extra queued requests before rejection [OK]

Common Mistakes:

• Assuming all requests pass immediately
• Ignoring burst parameter
• Thinking burst rejects requests

4. You configured:

limit_req_zone $binary_remote_addr zone=rlimit:10m rate=10r/s;
server {
  location / {
    limit_req zone=rlimit burst=5;
  }
}

But nginx logs show no rate limiting is applied. What is the likely error?

medium

A. Incorrect key used in limit_req_zone

B. The limit_req_zone directive must be inside server block

C. No nodelay option causing silent ignoring

D. Missing limit_req directive inside server block

Solution

1. Step 1: Check key correctness

   Using an incorrect key in limit_req_zone (e.g., $remote_addr instead of the preferred $binary_remote_addr) prevents proper rate limiting from being applied.

2. Step 2: Confirm directive placement

   limit_req_zone must be in http context, limit_req in server/location; placement here is correct.

3. Final Answer:

   Missing limit_req directive inside server block -> Option D

4. Quick Check:

   limit_req directive is required to apply limits [OK]

Hint: Check that limit_req directive is present inside server/location block [OK]

Common Mistakes:

• Placing limit_req_zone inside server block
• Assuming nodelay is required
• Not matching key with client IP

5. You want to limit requests to 10 per second per user IP but allow bursts of up to 20 requests without delay. Which configuration correctly achieves this?

hard

A. limit_req_zone $binary_remote_addr zone=fastlimit:10m rate=10r/s;
limit_req zone=fastlimit burst=20 nodelay;

B. limit_req_zone $remote_addr zone=fastlimit:10m rate=20r/s;
limit_req zone=fastlimit burst=10;

C. limit_req_zone $binary_remote_addr zone=fastlimit:10m rate=10r/s;
limit_req zone=fastlimit burst=20;

D. limit_req_zone $remote_addr zone=fastlimit:20m rate=10r/s;
limit_req zone=fastlimit burst=10 nodelay;

Solution

1. Step 1: Define correct rate and burst

   Rate is 10r/s, burst 20 means allow 20 extra requests queued without delay.

2. Step 2: Use nodelay to avoid delaying burst requests

   nodelay makes burst requests processed immediately, matching requirement.

3. Step 3: Validate key and zone size

   $binary_remote_addr is preferred key, 10m memory is sufficient.

4. Final Answer:

   limit_req_zone $binary_remote_addr zone=fastlimit:10m rate=10r/s; limit_req zone=fastlimit burst=20 nodelay; -> Option A

5. Quick Check:

   burst=20 with nodelay = immediate burst allowed [OK]

Hint: Use burst with nodelay for instant burst requests [OK]

Common Mistakes:

• Swapping burst and rate values
• Omitting nodelay causing delays
• Using wrong key variable