# Limit reqs per user / bot

**URL:** <https://www.ruby-forum.com/t/limit-reqs-per-user-bot/243795>\
**Category:** NGINX\
**Created:** [January 7, 2016, 11:31pm UTC](https://www.ruby-forum.com/t/limit-reqs-per-user-bot/243795 "2016-01-07T23:31:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [January 7, 2016, 11:31pm UTC](https://www.ruby-forum.com/t/limit-reqs-per-user-bot/243795/1 "2016-01-07T23:31:38Z")

</div>

I want to limit requests to 1 per second for each user, counting a bot  
that  
makes requests from multiple ips as a single user. Does this make sense:

map $http\_user\_agent $single\_user {  
default $binary\_remote\_addr;  
~PaperLiBot 1;  
}

limit\_req\_zone $single\_user zone=one:10m rate=1r/s;

…

limit\_req zone=one burst=2;

Thanks

Dave

Posted at Nginx Forum:

> **[Limit reqs per user / bot](https://forum.nginx.org/read.php?2,263891,263891#msg-263891)**
>
> I want to limit requests to 1 per second for each user, counting a bot that makes requests from multiple ips as a single user. Does this make sense: map $http\_user\_agent $single\_user { default $binary\_remote\_addr; ~PaperLiBot 1; } limit\_req\_zone

---

<div class="post-metadata">

**Author:** ![djeyewater](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/71e660/32.png) [@djeyewater](https://www.ruby-forum.com/u/djeyewater)\
**Post date:** [January 8, 2016, 7:39am UTC](https://www.ruby-forum.com/t/limit-reqs-per-user-bot/243795/2 "2016-01-08T07:39:59Z")

</div>

No because one user (web browser) can easily open 20 or more  
simultaneous  
connections to get a better web response.  
A bot might be less prone to do the same but most connect at about 5  
simultaneous connections.

Posted at Nginx Forum:

> **[Re: Limit reqs per user / bot](https://forum.nginx.org/read.php?2,263891,263894#msg-263894)**
>
> I want to limit requests to 1 per second for each user, counting a bot that makes requests from multiple ips as a single user. Does this make sense: map $http\_user\_agent $single\_user { default $binary\_remote\_addr; ~PaperLiBot 1; } limit\_req\_zone

---

<div class="post-metadata">

**Author:** ![djeyewater](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/71e660/32.png) [@djeyewater](https://www.ruby-forum.com/u/djeyewater)\
**Post date:** [January 8, 2016, 9:05pm UTC](https://www.ruby-forum.com/t/limit-reqs-per-user-bot/243795/3 "2016-01-08T21:05:02Z")

</div>

## You should use limit\_conn [http://nginx.org/en/docs/http/ngx\_http\_limit\_conn\_module.html#limit\_conn](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn) in conjunction with limit\_req [http://nginx.org/en/docs/http/ngx\_http\_limit\_req\_module.html#limit\_req](http://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req). They are supplementing each other.

_B. R._

On Fri, Jan 8, 2016 at 8:52 PM, djeyewater [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![djeyewater](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/71e660/32.png) [@djeyewater](https://www.ruby-forum.com/u/djeyewater)\
**Post date:** [January 9, 2016, 2:44pm UTC](https://www.ruby-forum.com/t/limit-reqs-per-user-bot/243795/4 "2016-01-09T14:44:41Z")

</div>

## B.R. Wrote:

> On Fri, Jan 8, 2016 at 8:52 PM, djeyewater
> 
> > The limit\_req will only be used for requests to dynamic pages, so  
> > there  
> > should only be one connection per user at a time.

But using my example config, which only allows 1 request per second per  
user, then wouldn’t limit\_conn be superfluous? You can’t have more than  
one  
connection for a single request, surely?  
I’ll paste the config again here as it got missed off the previous  
quote:

map $http\_user\_agent $single\_user {  
default $binary\_remote\_addr;  
~PaperLiBot 1;  
}

limit\_req\_zone $single\_user zone=one:10m rate=1r/s;

…

limit\_req zone=one burst=2;

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,263891,263913#msg-263913](https://forum.nginx.org/read.php?2,263891,263913#msg-263913)

---

<div class="post-metadata">

**Author:** ![djeyewater](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/71e660/32.png) [@djeyewater](https://www.ruby-forum.com/u/djeyewater)\
**Post date:** [January 10, 2016, 3:33pm UTC](https://www.ruby-forum.com/t/limit-reqs-per-user-bot/243795/5 "2016-01-10T15:33:43Z")

</div>

As you were said before, a client might create multiple connections.

nginx works per request on a connection. Several requests in parallel  
from  
different TCP connections (for the HTTP module) are not the same as  
several  
following requests on the same connection.

Limiting the number of requests applies to every connection in parallel,  
so  
the total requests rate per client is nbConn \* nbReq / timeUnit.  
limit\_conn and limit\_req work together in this formula.

## Do not assume things that are not said. I personally did exactly that on numerous occasions. :o)

_B. R._

On Sat, Jan 9, 2016 at 2:44 PM, djeyewater [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![djeyewater](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/71e660/32.png) [@djeyewater](https://www.ruby-forum.com/u/djeyewater)\
**Post date:** [January 8, 2016, 8:52pm UTC](https://www.ruby-forum.com/t/limit-reqs-per-user-bot/243795/6 "2016-01-08T20:52:45Z")

</div>

## itpp2012 Wrote:

> No because one user (web browser) can easily open 20 or more  
> simultaneous connections to get a better web response.  
> A bot might be less prone to do the same but most connect at about 5  
> simultaneous connections.

The limit\_req will only be used for requests to dynamic pages, so there  
should only be one connection per user at a time.

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,263891,263907#msg-263907](https://forum.nginx.org/read.php?2,263891,263907#msg-263907)