2

I've successfully set up rate limiting on IP addresses like so,

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

But I was wondering if its possible to do the same on referrers? For example, if a site gets placed in an iframe on a third party site, which generates too much traffic to handle.

I can't find any nginx variables for the referrer anywhere.

I don't want to block traffic completely, just limit the traffic that comes from an iframe.

Is this possible? Or can the solution be achieved in a different way?

Thanks.

  • 2
    Probably you should always bust your site out of a frame. There's little good reason to let a third party do this. – Michael Hampton Oct 21 '13 at 17:13
  • Normally I would agree, but this is one of those times where a third party would need to do this. – SteveEdson Oct 24 '13 at 8:58
  • Yes, it is possible. I may explain it in a detailed reply if you wish. – Maxim Masiutin May 12 '17 at 15:36
  • Thanks Maxim, but this question is 3.5 years old, so no longer necessary for me personally. However, if you think it might help other people, go for it. – SteveEdson May 15 '17 at 15:49
2

@R1CH_TL on Twitter suggested using something like this:

map $http_referer $limit_ip_key {
    default $binary_remote_addr;
    "http://domain-to-limit.co.uk/" 1;
}

limit_req_zone  $limit_ip_key        zone=two:10m   rate=1r/s;

Would this method work? And would it be better than silasistefan's solution?

1

Did you try something like this?

location / {

    error_page 410 = @ads;

    # if referrer is invalid then limit
    valid_referers none blocked www.domain.com;
    if ($invalid_referer) {
        return   410;
    }

    # if ?isAD=1 then limit
    if ($arg_isAD = "1"){
        return 410;
    }

    root   /var/www;
}

location @ads {
    limit_req   zone=one  burst=5;
}
  • Interesting method, how would that compare to the other solution? – SteveEdson Oct 24 '13 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.