How does Nginx implement rate limiting?
Understand Nginx rate limiting with limit_req_zone and limit_req, the leaky-bucket algorithm, burst, and nodelay to protect backends from abuse.
Expected Interview Answer
Nginx implements rate limiting with the limit_req module, which uses the leaky-bucket algorithm: you define a shared-memory zone and a rate with limit_req_zone, then enforce it on a location with limit_req.
limit_req_zone declares a key (commonly $binary_remote_addr), a named shared memory zone, and a rate such as 10r/s. Applying limit_req zone=name burst=20 nodelay in a location smooths bursts through a queue while rejecting excess requests with HTTP 503 (configurable via limit_req_status). Nginx also offers limit_conn for capping concurrent connections per key, making the two modules complementary tools for protecting backends from abuse and traffic spikes.
- Protects backends from traffic spikes and abuse
- Mitigates brute-force and scraping attacks
- Smooths bursts with a configurable queue
- Enforced at the edge before hitting app servers
- Low overhead using shared-memory zones
AI Mentor Explanation
Rate limiting is like an over-rate rule that caps how many balls a side may bowl in a set time. Bowlers can send a short burst quickly, but sustained delivery must average the allowed rate; go too fast and the umpire holds up play. The burst allowance is the small cushion of extra balls tolerated before the penalty kicks in.
Step-by-Step Explanation
Step 1
Define a limit zone
In http, add limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s; to key by client IP.
Step 2
Apply the limit
In the target location, add limit_req zone=api; to enforce the configured rate on that route.
Step 3
Allow short bursts
Add burst=20 so brief spikes queue instead of being dropped immediately.
Step 4
Choose queueing behaviour
Add nodelay to serve queued burst requests immediately, or delay to space them out.
Step 5
Tune the reject response
Optionally set limit_req_status 429; and test with nginx -t before reloading.
What Interviewer Expects
- Names limit_req_zone and limit_req directives
- Knows it uses the leaky-bucket algorithm
- Explains the key, zone, and rate parameters
- Understands burst and nodelay behaviour
- Distinguishes limit_req from limit_conn
Common Mistakes
- Confusing limit_req (request rate) with limit_conn (concurrent connections)
- Defining limit_req_zone inside a location instead of http
- Setting a rate but forgetting burst, causing legitimate spikes to fail
- Thinking nodelay disables the limit rather than the queue delay
- Ignoring that the default reject status is 503, not 429
Best Answer (HR Friendly)
“Nginx rate limiting controls how many requests a visitor can make in a given time. It lets a small burst through but blocks anyone flooding the site, which protects the servers from overload and abuse like brute-force attacks.”
Code Example
http {
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
server {
listen 80;
location /api/ {
limit_req zone=api burst=20 nodelay;
limit_req_status 429;
proxy_pass http://app_backend;
}
}
}Follow-up Questions
- What is the difference between limit_req and limit_conn?
- How does the burst parameter change behaviour, and what does nodelay do?
- Why is $binary_remote_addr preferred over $remote_addr as the key?
- How would you rate-limit by API key or header instead of IP?
- What algorithm underlies limit_req and how does it smooth traffic?
MCQ Practice
1. Which algorithm does Nginx limit_req use?
Nginx's limit_req module implements the leaky-bucket algorithm to smooth request rates.
2. What does the burst parameter control?
burst sets how many requests above the rate can be queued before Nginx starts rejecting.
3. What is the default HTTP status when a request exceeds the limit?
By default Nginx returns 503 Service Unavailable; limit_req_status can change it to 429.
Flash Cards
Directive that defines the rate zone? — limit_req_zone, placed in the http context.
Directive that enforces the limit? — limit_req, used inside a location or server block.
What does burst do? — Queues a number of excess requests instead of rejecting them immediately.
What does nodelay do? — Serves queued burst requests immediately rather than spacing them out.
limit_req vs limit_conn? — limit_req caps request rate over time; limit_conn caps concurrent connections.