How do you trust client IPs and rate-limit behind a CDN?

Question

IT Interview Practice · Accepted Answer

Restore the client address from a trusted proxy before limiting requests by IP. Otherwise many visitors can be counted as one CDN server.

## Why the wrong people get blocked

Alice and Bob both pass through the same CDN address. Without real-IP handling, Nginx sees that CDN address for both. Alice's traffic can consume the quota that Bob appears to share.

## Trust the proxy, not any incoming header

This illustrative configuration belongs inside `http`. The documentation-only address must be replaced by actual trusted proxy ranges; the example assumes the proxy maintains `X-Forwarded-For` correctly:

```nginx
set_real_ip_from 192.0.2.10;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
limit_req_zone $binary_remote_addr zone=per_client:10m rate=5r/s;

server {
    listen 80;
    location /api/ {
        limit_req zone=per_client burst=10;
        limit_req_status 429;
        proxy_pass http://127.0.0.1:3000;
    }
}
```

`set_real_ip_from` identifies who may supply the address. Recursive processing selects the last non-trusted address in the forwarded chain. `limit_req_zone` then counts using the restored client IP; `limit_req` applies the limit to the route. Here excess requests within the burst can be delayed, while those beyond it are rejected. The rates are examples, not production defaults.

## Verify before enforcing

Use `limit_req_dry_run on;` during evaluation. Check two client addresses and attempts to forge headers from an untrusted source. Restrict direct origin access and maintain trusted ranges. Shared office IPs still group real people together, so supplement IP limits with authenticated account limits where needed.

[Official documentation](https://nginx.org/en/docs/http/ngx_http_realip_module.html).

Why the wrong people get blocked

Trust the proxy, not any incoming header

Verify before enforcing

Related questions