# How to limit\_req depending if the requests has a REFERER or not

**URL:** <https://www.ruby-forum.com/t/how-to-limit-req-depending-if-the-requests-has-a-referer-or-not/220323>\
**Category:** NGINX\
**Created:** [June 6, 2012, 12:33am UTC](https://www.ruby-forum.com/t/how-to-limit-req-depending-if-the-requests-has-a-referer-or-not/220323 "2012-06-06T00:33:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [June 6, 2012, 12:33am UTC](https://www.ruby-forum.com/t/how-to-limit-req-depending-if-the-requests-has-a-referer-or-not/220323/1 "2012-06-06T00:33:41Z")

</div>

I have something like this… I need to be able to apply three different  
limit\_req depending:

a.) If the referer to click.php is [domain.com](http://domain.com) … apply zone1  
b.) If there is some other referer apply zone2 on click.php  
c.) If there is no referer apply zone3 on click.php

location /click.php { limit\_req zone=one; proxy\_pass [http://backend](http://backend);  
}

Thanks guys

---

<div class="post-metadata">

**Author:** ![jchengj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/d78d45/32.png) [@jchengj](https://www.ruby-forum.com/u/jchengj)\
**Post date:** [June 6, 2012, 1:32am UTC](https://www.ruby-forum.com/t/how-to-limit-req-depending-if-the-requests-has-a-referer-or-not/220323/2 "2012-06-06T01:32:07Z")

</div>

On Wednesday 06 June 2012 02:33:09 Joseph C. wrote:

> I have something like this… I need to be able to apply three different  
> limit\_req depending:
> 
> a.) If the referer to click.php is [domain.com](http://domain.com) … apply zone1  
> b.) If there is some other referer apply zone2 on click.php  
> c.) If there is no referer apply zone3 on click.php
> 
> location /click.php { limit\_req zone=one; proxy\_pass [http://backend](http://backend); }

Probably, something like this will work:

http {

```
 map $http_referer $is_referer {
     default '';
     ~^. 1;
 }

 map $is_referer $no_referer {
     default 1;
     1 '';
 }

 map $invalid_referer $zone1 {
     0 1;
     1 '';
 }

 map $invalid_referer $zone2 {
     0 '';
     1 $is_referer;
 }

 map $invalid_referer $zone3 {
     0 '';
     1 $no_referer;
 }

 limit_req_zone $zone1 zone=zone1:128k rate=50r/s;
 limit_req_zone $zone2 zone=zone2:128k rate=10r/s;
 limit_req_zone $zone3 zone=zone3:128k rate=3r/s;

 server {
     valid_referers domain.com;

     location /click.php {
         limit_req zone=zone3 burst=12;
         limit_req zone=zone2 burst=10 nodelay;
         limit_req zone=zone1 burst=100 nodelay;
         ...

```

wbr, Valentin V. Bartenev

---

<div class="post-metadata">

**Author:** ![jchengj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/d78d45/32.png) [@jchengj](https://www.ruby-forum.com/u/jchengj)\
**Post date:** [June 6, 2012, 9:15am UTC](https://www.ruby-forum.com/t/how-to-limit-req-depending-if-the-requests-has-a-referer-or-not/220323/3 "2012-06-06T09:15:00Z")

</div>

On Wednesday 06 June 2012 03:31:03 Valentin V. Bartenev wrote:

> On Wednesday 06 June 2012 02:33:09 Joseph C. wrote:
> 
> > I have something like this… I need to be able to apply three different  
> > limit\_req depending:
> > 
> > a.) If the referer to click.php is [domain.com](http://domain.com) … apply zone1  
> > b.) If there is some other referer apply zone2 on click.php  
> > c.) If there is no referer apply zone3 on click.php
> > 
> > location /click.php { limit\_req zone=one; proxy\_pass [http://backend](http://backend); }  
> > […]
> 
> ```
> map $invalid_referer $zone3 {
> 0 '';
> 1 $no_referer;
> }
> 
> ```

[…]

Oops, Ruslan E. pointed out to me that the “false” value of  
$invalid\_referer is an empty string, not “0”.

> **[Module ngx\_http\_referer\_module](http://nginx.org/en/docs/http/ngx_http_referer_module.html#valid_referers)**
>
> The ngx\_http\_referer\_module module is used to block access to a site for requests with invalid values in the “Referer” header field. It should be kept in mind that fabricating a request with an appropriate “Referer” field value is quite easy, and so...

Well, then the correct config example is as follows:

http {

```
 map $http_referer $zone3 {
     default 1;
     ~^. '';
 }

 map $zone3 $zone2 {
     default $invalid_referer;
     1 '';
 }

 map $invalid_referer $zone1 {
     default 1;
     1 '';
 }

 limit_req_zone $zone1 zone=zone1:128k rate=50r/s;
 limit_req_zone $zone2 zone=zone2:128k rate=10r/s;
 limit_req_zone $zone3 zone=zone3:128k rate=3r/s;

 server {
     valid_referers domain.com;

     location /click.php {
         limit_req zone=zone3 burst=12;
         limit_req zone=zone2 burst=10 nodelay;
         limit_req zone=zone1 burst=100 nodelay;
         ...

```

wbr, Valentin V. Bartenev