为什么 Nginx 速率限制不拒绝超出的请求？

Question

这是我的 nginx 配置：

{
    # on top of conf file
    limit_req_zone $binary_remote_addr zone=main:10m rate=1r/s;  
    ...

    location /login {
            limit_req zone=main burst=3 nodelay;
            ModSecurityEnabled on;
            ModSecurityConfig /usr/local/nginx/conf/modsecurity.conf;
            proxy_pass http://localhost:4000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_set_header Host $host;
            proxy_cache_bypass $http_upgrade;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

}

使用以下代码多次点击 api url (http://localhost:4000/login) 时 -

for i in {0..2000}; do (curl -Is http://localhost:4000/login | head -n1 &) 2>/dev/null; done

对于一些应该被拒绝的请求，我总是得到 200 响应代码而不是 503。为什么会这样？

Answer 1

对我来说 limit_req 也不起作用。问题是顺序错误 -limit_req应该出现在之前proxy_pass

作品：

limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s;

server {
  listen      443;
  server_name example.com;

  limit_req zone=req_limit_per_ip burst=10 nodelay;

  location / {
    proxy_pass         http://be_server;
  }
}

作品

limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s;

server {
  listen      443;
  server_name example.com;

  location / {
    limit_req zone=req_limit_per_ip burst=10 nodelay;

    proxy_pass         http://be_server;
  }
}

不起作用

limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s;

server {
  listen      443;
  server_name example.com;

  location / {
    proxy_pass         http://be_server;

    limit_req zone=req_limit_per_ip burst=10 nodelay;
  }
}

Answer 2

这是我的配置。现在它在 passign tthe 阈值后正确显示 200 和 503 请求。

limit_req_zone $http_x_forwarded_for zone=req_limit_per_ip:100m rate=10r/m;
limit_conn_zone $http_x_forwarded_for zone=conn_limit_per_ip:100m;


server {

listen 80;

server_name *.xxxxxx.com;
add_header 'Access-Control-Allow-Headers' "X-Forwarded-For; X-Forwarded-Proto; X-Forwarded-Port; Host; X-Amzn-Trace-Id; Connection";
#add_header 'Access-Control-Allow-Headers' "X-Requested-With";
add_header 'Access-Control-Allow-Methods' "GET, POST, OPTIONS";
#add_header 'Access-Control-Allow-Origin' "$http_origin";

server_tokens off;
client_body_timeout 60s;
client_header_timeout 60s;
add_header 'X-Frame-Options' "SAMEORIGIN";
add_header 'Strict-Transport-Security' "max-age=31536000; includeSubDomains" ;

location /api/ {
    ModSecurityEnabled off;
    ModSecurityConfig /usr/local/nginx/conf/modsecurity.conf;
    limit_req zone=req_limit_per_ip burst=10 nodelay;
    proxy_pass http://xx.xxx.xxx.xxx:7000/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
    proxy_connect_timeout       60s;
    proxy_send_timeout          60s;
    proxy_read_timeout          60s;
    send_timeout                60s;

}
}

为了检查效果，我创建了一个 .js 文件并在循环中请求了上述 url 20 次。您可以查看以下结果 -

输出：