Nginx rate limiting and request buffering

Rate limiting protects upstreams from abuse and accidental retry storms. `limit_req_zone` plus `limit_req` implement leaky-bucket style throttling with burst allowance.

					limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
  location /api/ {
    limit_req zone=api burst=20 nodelay;
    client_max_body_size 2m;
    proxy_request_buffering on;
    proxy_read_timeout 60s;
    proxy_pass http://node_upstream;
  }
}
				

Request buffering reads the full client body before forwarding — protects slow Node parsers from slowloris-style clients but increases memory use. `proxy_request_buffering off` streams large uploads if the app supports it.

On interviews: align Nginx timeouts with Node server timeouts; return 429 vs 503; per-IP limits versus per-API-key limits at gateway layer.

Common pitfalls: burst too low blocking legitimate traffic spikes; body size limits without clear 413 responses; mismatched timeouts causing 502 while app still works.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Rate limit at the edge for anonymous abuse.
• Set client_max_body_size explicitly.
• Match proxy and app timeouts.
• Log rejected requests with client identity.