lmit_req with differents rules

R
Rejaine
  • 15 Dec '22
Hello!!

I need apply different limit_req rules with different rules, like

limit_req_zone $binary_remote_addr zone=ipsrc:10m rate=1r/s;
limit_req_zone $arg_token zone=apitoken:10m rate=5r/m;
limit_req_zone $http_autorization zone=httpauth:10m rate=5r/s;

server {
    listen       443;
    server_name  api.domain.com;
  }

location / {
        limit_req zone=ipsrc;
        limit_req zone=apitoken;
         limit_req zone=httpauth;
        proxy_pass http://internal.api.com;
       }
}

Would this be correct and should it work as expected?

-- 
*Esta mensagem pode conter informações confidenciais ou privilegiadas, 
sendo seu sigilo protegido por lei. Se você não for o destinatário ou a 
pessoa autorizada a receber esta mensagem, não pode usar, copiar ou 
divulgar as informações nela contidas ou tomar qualquer ação baseada nessas 
informações. Se você recebeu esta mensagem por engano, por favor avise 
imediatamente ao remetente, respondendo o e-mail e em seguida apague-o. 
Agradecemos sua cooperação.*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20221215/d54b23e1/attachment-0001.htm>
M
Maxim
  • 15 Dec '22
Hello!

On Thu, Dec 15, 2022 at 09:50:46AM -0300, Rejaine Monteiro wrote:

> Hello!!
> 
> I need apply different limit_req rules with different rules, like
> 
> limit_req_zone $binary_remote_addr zone=ipsrc:10m rate=1r/s;
> limit_req_zone $arg_token zone=apitoken:10m rate=5r/m;
> limit_req_zone $http_autorization zone=httpauth:10m rate=5r/s;
> 
> server {
>     listen       443;
>     server_name  api.domain.com;
>   }
> 
> location / {
>         limit_req zone=ipsrc;
>         limit_req zone=apitoken;
>          limit_req zone=httpauth;
>         proxy_pass http://internal.api.com;
>        }
> }
> 
> Would this be correct and should it work as expected?

This is certainly supported, see http://nginx.org/r/limit_req for 
details.

Note that it might be a good idea to add some meaningful "burst" 
to the configuration, as well as "nodelay".

-- 
Maxim Dounin
http://mdounin.ru/
  • Page 1 of 1
Reply