Rate Limiting

Manage incoming client requests by controlling both the request rate and concurrent connections. This prevents resource exhaustion, abuse, and helps mitigate DDoS, brute-force attacks, web scraping, and API overuse.

What Is Rate Limiting?

Imagine you’re driving in a 100 km/h zone at 90 km/h—well under the limit—while another car speeds past at 130 km/h.

A traffic officer pulls over the speeder and issues a ticket when the limit is exceeded.

Rate limiting applies the same principle to web servers: defining thresholds so that any client exceeding the limit receives an HTTP 429 (Too Many Requests).

Why Rate Limiting Matters

• Protects against DDoS (Distributed Denial of Service)
• Thwarts brute-force password guessing
• Prevents large-scale web scraping
• Controls API abuse for endpoints like social networks

Brute-Force Attacks

Automated scripts try credentials repeatedly—targeting login pages until they succeed.

Web Scraping

Scripts extract valuable data from sites (e.g., copying car listings from Autotrader).

API Overuse

Endpoints (like Instagram’s post, like, follow, DM APIs) must limit calls to stay responsive.

Every rate-limit implementation tracks:

• Client IP address
• Interval between requests
• Total requests within a time window

If a client exceeds the configured limit, NGINX returns HTTP 429 until the next window or token refill.

NGINX Rate Limiting Methods

NGINX provides two core rate-limiting mechanisms:

For more details, see the NGINX documentation.

1. Request Rate Limiting

Implements a token bucket algorithm, allowing a defined number of requests per time unit. Excess requests get delayed or rejected with HTTP 429.

In the http context:

http {
    # Allocate 10 MB shared memory for tracking each IP ($binary_remote_addr)
    # and allow up to 2r/m (2 requests per minute).
    limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=2r/m;

    # When limit is exceeded, respond with 429 Too Many Requests.
    limit_req_status 429;
}

Apply the limit to a specific location within your server block:

server {
    listen 80;
    server_name example.com www.example.com;

    root /var/www/example.com/html;
    index index.html;

    location /admin {
        # Enforce request limit for this location
        limit_req zone=req_limit_per_ip;

        # Standard file serving
        try_files $uri $uri/ =404;
    }
}

2. Connection Rate Limiting

Restricts the number of concurrent connections per client IP—ideal against SYN floods or slow-loris style attacks.

In the http context:

http {
    # Zone for tracking connections per IP
    limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;

    # Return 429 when connection limit is reached
    limit_conn_status 429;
}

Then in your server block:

server {
    listen 80;
    server_name example.com www.example.com;

    location /admin {
        # Allow only 1 simultaneous connection per IP
        limit_conn conn_limit_per_ip 1;

        try_files $uri $uri/ =404;
    }
}

Increase the last parameter (e.g., 2) to allow more parallel connections.

Implement these NGINX configurations to safeguard your web server against abuse and ensure consistent performance under load.

References

• NGINX Limit Request Module
• NGINX Limit Connection Module
• Token Bucket Algorithm
• Denial-of-Service Attack