Why rate limiting prevents abuse in Nginx - See It in Action

Why Rate Limiting Prevents Abuse with Nginx

📖 Scenario: You manage a website that sometimes gets too many requests from the same user or bot. This can slow down your site or cause it to crash. To keep your site safe and fast, you want to limit how many requests each user can make in a short time.

🎯 Goal: You will create a simple Nginx configuration that limits the number of requests a user can make per minute. This helps prevent abuse by stopping too many requests from the same user.

📋 What You'll Learn

Create a shared memory zone for rate limiting

Set a limit for requests per minute per IP address

Apply the rate limit to the server location

Display the final Nginx configuration with rate limiting

💡 Why This Matters

🌍 Real World

Websites often face too many requests from the same user or bot, which can slow down or crash the site. Rate limiting helps keep the site stable and fair for all users.

💼 Career

Understanding rate limiting is important for DevOps roles to protect web servers from abuse and ensure reliable service.

1

Create a shared memory zone for rate limiting

Write a line to create a shared memory zone called one with size 10m using the limit_req_zone directive. Use $binary_remote_addr as the key and set the rate to 10r/m (10 requests per minute).

Nginx

# Your code here

Hint

This line tells Nginx to track requests by user IP and limit them to 10 per minute.

2

Set the rate limit in the server block

Inside the server block, add a limit_req directive that uses the zone one to apply the rate limit.

Nginx

limit_req_zone $binary_remote_addr zone=one:10m rate=10r/m;

server {
    listen 80;
    server_name example.com;

    # Add limit_req directive here
}

Hint

This applies the rate limit you defined to all requests handled by this server.

3

Apply rate limiting to a specific location

Inside the server block, add a location / block. Inside it, add the limit_req zone=one; directive to apply rate limiting only to the root URL.

Nginx

limit_req_zone $binary_remote_addr zone=one:10m rate=10r/m;

server {
    listen 80;
    server_name example.com;

    limit_req zone=one;

    # Add location block with limit_req here
}

Hint

This limits requests only when users access the main page or any URL under root.

4

Display the final Nginx configuration

Write a command to print the full Nginx configuration file named nginx.conf.

Nginx

limit_req_zone $binary_remote_addr zone=one:10m rate=10r/m;

server {
    listen 80;
    server_name example.com;

    location / {
        limit_req zone=one;
    }
}

# Your code here

Hint

This command shows the full configuration so you can check your work.

Practice

1. What is the main purpose of rate limiting in nginx?

easy

A. To increase the speed of all incoming requests

B. To control how many requests a user can make in a given time

C. To allow unlimited access to all users

D. To block all requests from unknown IPs

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts the number of requests a user can send in a certain time to prevent overload.

2. Step 2: Identify the main purpose in nginx

   In nginx, rate limiting is used to control request rates to protect the server from abuse.

3. Final Answer:

   To control how many requests a user can make in a given time -> Option B

4. Quick Check:

   Rate limiting = control request count [OK]

Hint: Rate limiting means controlling request numbers per time [OK]

Common Mistakes:

• Thinking it speeds up requests
• Believing it blocks all unknown users
• Assuming it allows unlimited access

2. Which of the following is the correct nginx directive to set a rate limit zone named 'mylimit' with 10MB shared memory?

easy

A. limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s

B. limit_req_zone $remote_addr zone=mylimit:10mb rate=10r/s;

C. limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;

D. limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;;

Solution

1. Step 1: Check syntax for limit_req_zone

   The correct syntax uses $binary_remote_addr, zone name with size (10m), and rate with r/s, ending with a semicolon.

2. Step 2: Identify correct option

   limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; matches correct syntax exactly: 'limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;'

3. Final Answer:

   limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; -> Option C

4. Quick Check:

   Correct syntax = limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; [OK]

Hint: Remember $binary_remote_addr and 'zone=name:size' syntax [OK]

Common Mistakes:

• Using '10mb' instead of '10m' for memory size
• Missing semicolon at end
• Using $remote_addr instead of $binary_remote_addr

3. Given this nginx config snippet:

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
server {
  location / {
    limit_req zone=one burst=2;
  }
}

What happens if a user sends 4 requests in 1 second?

medium

A. 1 request is processed immediately, others are delayed or rejected

B. All 4 requests are processed immediately

C. All requests are rejected

D. Requests are queued indefinitely

Solution

1. Step 1: Understand rate and burst settings

   The rate=1r/s allows 1 request per second. The burst=2 allows 2 extra requests to be queued temporarily.

2. Step 2: Analyze 4 requests in 1 second

   First request is processed immediately, next 2 are allowed by burst (delayed), the 4th exceeds burst and is rejected.

3. Final Answer:

   1 request is processed immediately, others are delayed or rejected -> Option A

4. Quick Check:

   Rate 1r/s + burst 2 = 1 immediate + 2 delayed, 4th rejected [OK]

Hint: Burst allows extra requests beyond rate, but not unlimited [OK]

Common Mistakes:

• Assuming all requests pass immediately
• Thinking burst means unlimited queue
• Believing all requests get rejected

4. You configured nginx rate limiting but users still flood your server. Which mistake might cause this?

medium

A. Using $remote_addr instead of $binary_remote_addr in limit_req_zone

B. Using rate=10r/s instead of 10r/m

C. Setting burst value too low

D. Not enabling limit_req in the server block

Solution

1. Step 1: Check if limit_req is enabled

   Defining limit_req_zone alone does not apply rate limiting; limit_req must be enabled in location or server block.

2. Step 2: Identify why flooding continues

   If limit_req is missing, nginx does not limit requests despite zone definition, causing flooding.

3. Final Answer:

   Not enabling limit_req in the server block -> Option D

4. Quick Check:

   limit_req must be active to enforce limits [OK]

Hint: Define zone and enable limit_req to activate rate limiting [OK]

Common Mistakes:

• Thinking limit_req_zone alone limits requests
• Confusing $remote_addr and $binary_remote_addr as critical error here
• Misunderstanding burst effect

5. You want to protect your nginx server from abuse by limiting requests to 5 per second per IP, allowing bursts of 10. Which configuration snippet correctly applies this?

hard

A. limit_req_zone $binary_remote_addr zone=addr:10m rate=5r/s;\nserver {\n location / {\n limit_req zone=addr burst=10 nodelay;\n }\n}

B. limit_req_zone $remote_addr zone=addr:10m rate=5r/s;\nserver {\n location / {\n limit_req zone=addr burst=10 delay;\n }\n}

C. limit_req_zone $binary_remote_addr zone=addr:10m rate=10r/s;\nserver {\n location / {\n limit_req zone=addr burst=5 nodelay;\n }\n}

D. limit_req_zone $binary_remote_addr zone=addr:5m rate=5r/m;\nserver {\n location / {\n limit_req zone=addr burst=10 nodelay;\n }\n}

Solution

1. Step 1: Verify rate_req_zone parameters

   The zone must use $binary_remote_addr, 10m memory, and rate=5r/s to limit 5 requests per second per IP.

2. Step 2: Check limit_req settings

   limit_req must use the same zone, burst=10 to allow 10 extra requests, and nodelay to process bursts immediately.

3. Final Answer:

   limit_req_zone $binary_remote_addr zone=addr:10m rate=5r/s; server { location / { limit_req zone=addr burst=10 nodelay; } } -> Option A

4. Quick Check:

   Correct zone + burst + nodelay = limit_req_zone $binary_remote_addr zone=addr:10m rate=5r/s;\nserver {\n location / {\n limit_req zone=addr burst=10 nodelay;\n }\n} [OK]

Hint: Match zone name and use burst with nodelay for immediate bursts [OK]

Common Mistakes:

• Using $remote_addr instead of $binary_remote_addr
• Mixing rate units (r/s vs r/m)
• Setting burst lower than required