Why rate limiting prevents abuse in Nginx - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set the rate limit zone name to 'mylimit'.

Nginx

limit_req_zone $binary_remote_addr zone=[1]:10m rate=1r/s;

Drag options to blanks, or click blank then click option'

Amylimit

Bzone1

Climit

Daddrlimit

Attempts:

3 left

💡 Hint

Common Mistakes

Using a reserved word like 'limit' as the zone name.

The zone name 'mylimit' is used to identify the shared memory zone for rate limiting.

2fill in blank

medium

Complete the code to apply the rate limit using the zone 'mylimit'.

Nginx

limit_req zone=[1] burst=5 nodelay;

Drag options to blanks, or click blank then click option'

Amylimit

Bzone1

Climit

Daddrlimit

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different zone name than defined.

The 'limit_req' directive uses the zone name defined earlier to apply the rate limit.

3fill in blank

hard

Fix the error in the rate limit directive to correctly limit requests to 10 per second.

Nginx

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=[1];

Drag options to blanks, or click blank then click option'

A10/s

B10r/s

C10rps

D10requests

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting 'r/s' or using incorrect units like '10/s'.

The correct syntax for rate is '10r/s' meaning 10 requests per second.

4fill in blank

hard

Fill both blanks to limit requests from the same IP to 5 per second with a burst of 10.

Nginx

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=[1];
limit_req zone=mylimit burst=[2] nodelay;

Drag options to blanks, or click blank then click option'

A5r/s

B10r/s

C5

D10

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing rate and burst values or units.

The rate is set to '5r/s' for 5 requests per second, and burst is set to 10 to allow short bursts.

5fill in blank

hard

Fill all three blanks to create a rate limit zone named 'limitzone' with 20MB memory, limit 15 requests per second, and apply it with burst 20.

Nginx

limit_req_zone $binary_remote_addr zone=[1]:[2] rate=[3];
limit_req zone=limitzone burst=20 nodelay;

Drag options to blanks, or click blank then click option'

Alimitzone

B15r/s

C20m

D10m

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong memory size units or wrong rate format.

The zone name is 'limitzone', memory size is '20m' (20 megabytes), and rate is '15r/s' for 15 requests per second.

Practice

1. What is the main purpose of rate limiting in nginx?

easy

A. To increase the speed of all incoming requests

B. To control how many requests a user can make in a given time

C. To allow unlimited access to all users

D. To block all requests from unknown IPs

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts the number of requests a user can send in a certain time to prevent overload.

2. Step 2: Identify the main purpose in nginx

   In nginx, rate limiting is used to control request rates to protect the server from abuse.

3. Final Answer:

   To control how many requests a user can make in a given time -> Option B

4. Quick Check:

   Rate limiting = control request count [OK]

Hint: Rate limiting means controlling request numbers per time [OK]

Common Mistakes:

• Thinking it speeds up requests
• Believing it blocks all unknown users
• Assuming it allows unlimited access

2. Which of the following is the correct nginx directive to set a rate limit zone named 'mylimit' with 10MB shared memory?

easy

A. limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s

B. limit_req_zone $remote_addr zone=mylimit:10mb rate=10r/s;

C. limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;

D. limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;;

Solution

1. Step 1: Check syntax for limit_req_zone

   The correct syntax uses $binary_remote_addr, zone name with size (10m), and rate with r/s, ending with a semicolon.

2. Step 2: Identify correct option

   limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; matches correct syntax exactly: 'limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;'

3. Final Answer:

   limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; -> Option C

4. Quick Check:

   Correct syntax = limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s; [OK]

Hint: Remember $binary_remote_addr and 'zone=name:size' syntax [OK]

Common Mistakes:

• Using '10mb' instead of '10m' for memory size
• Missing semicolon at end
• Using $remote_addr instead of $binary_remote_addr

3. Given this nginx config snippet:

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
server {
  location / {
    limit_req zone=one burst=2;
  }
}

What happens if a user sends 4 requests in 1 second?

medium

A. 1 request is processed immediately, others are delayed or rejected

B. All 4 requests are processed immediately

C. All requests are rejected

D. Requests are queued indefinitely

Solution

1. Step 1: Understand rate and burst settings

   The rate=1r/s allows 1 request per second. The burst=2 allows 2 extra requests to be queued temporarily.

2. Step 2: Analyze 4 requests in 1 second

   First request is processed immediately, next 2 are allowed by burst (delayed), the 4th exceeds burst and is rejected.

3. Final Answer:

   1 request is processed immediately, others are delayed or rejected -> Option A

4. Quick Check:

   Rate 1r/s + burst 2 = 1 immediate + 2 delayed, 4th rejected [OK]

Hint: Burst allows extra requests beyond rate, but not unlimited [OK]

Common Mistakes:

• Assuming all requests pass immediately
• Thinking burst means unlimited queue
• Believing all requests get rejected

4. You configured nginx rate limiting but users still flood your server. Which mistake might cause this?

medium

A. Using $remote_addr instead of $binary_remote_addr in limit_req_zone

B. Using rate=10r/s instead of 10r/m

C. Setting burst value too low

D. Not enabling limit_req in the server block

Solution

1. Step 1: Check if limit_req is enabled

   Defining limit_req_zone alone does not apply rate limiting; limit_req must be enabled in location or server block.

2. Step 2: Identify why flooding continues

   If limit_req is missing, nginx does not limit requests despite zone definition, causing flooding.

3. Final Answer:

   Not enabling limit_req in the server block -> Option D

4. Quick Check:

   limit_req must be active to enforce limits [OK]

Hint: Define zone and enable limit_req to activate rate limiting [OK]

Common Mistakes:

• Thinking limit_req_zone alone limits requests
• Confusing $remote_addr and $binary_remote_addr as critical error here
• Misunderstanding burst effect

5. You want to protect your nginx server from abuse by limiting requests to 5 per second per IP, allowing bursts of 10. Which configuration snippet correctly applies this?

hard

A. limit_req_zone $binary_remote_addr zone=addr:10m rate=5r/s;\nserver {\n location / {\n limit_req zone=addr burst=10 nodelay;\n }\n}

B. limit_req_zone $remote_addr zone=addr:10m rate=5r/s;\nserver {\n location / {\n limit_req zone=addr burst=10 delay;\n }\n}

C. limit_req_zone $binary_remote_addr zone=addr:10m rate=10r/s;\nserver {\n location / {\n limit_req zone=addr burst=5 nodelay;\n }\n}

D. limit_req_zone $binary_remote_addr zone=addr:5m rate=5r/m;\nserver {\n location / {\n limit_req zone=addr burst=10 nodelay;\n }\n}

Solution

1. Step 1: Verify rate_req_zone parameters

   The zone must use $binary_remote_addr, 10m memory, and rate=5r/s to limit 5 requests per second per IP.

2. Step 2: Check limit_req settings

   limit_req must use the same zone, burst=10 to allow 10 extra requests, and nodelay to process bursts immediately.

3. Final Answer:

   limit_req_zone $binary_remote_addr zone=addr:10m rate=5r/s; server { location / { limit_req zone=addr burst=10 nodelay; } } -> Option A

4. Quick Check:

   Correct zone + burst + nodelay = limit_req_zone $binary_remote_addr zone=addr:10m rate=5r/s;\nserver {\n location / {\n limit_req zone=addr burst=10 nodelay;\n }\n} [OK]

Hint: Match zone name and use burst with nodelay for immediate bursts [OK]

Common Mistakes:

• Using $remote_addr instead of $binary_remote_addr
• Mixing rate units (r/s vs r/m)
• Setting burst lower than required