cis-nginx-v300-5-2-5

name	cis-nginx-v300-5-2-5
description	Ensure rate limits by IP address are set (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","request-limits","request-filtering"]
cis_id	5.2.5
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 5.2.5 — Ensure rate limits by IP address are set

Profile Applicability

• Level 2 - Webserver
• Level 2 - Proxy
• Level 2 - Loadbalancer

Description

NGINX's ngx_http_limit_req_module provides a mechanism to limit the rate of incoming requests from a single client IP address, based on the "leaky bucket" algorithm. This is configured in two steps:

1. limit_req_zone: This directive, defined in the http block, creates a shared memory zone that defines the bucket's parameters, such as the average request rate.

2. limit_req: This directive, applied in a server or location block, enforces the rate limit using a specific zone and defines how "bursts" of traffic are handled.

When a client exceeds the defined rate, NGINX will reject new requests with a 503 Service Temporarily Unavailable error.

Rationale

Rate limiting is the primary defense against application-level, high-frequency attacks. Its main purpose is to prevent brute-force password guessing on login endpoints, API abuse by automated scripts, and aggressive content scraping. Unlike connection limiting (limit_conn), which focuses on slow, simultaneous connections, rate limiting (limit_req) targets clients making an excessive number of requests in a short period.

Impact

Applying a global, aggressive rate limit is extremely dangerous and will almost certainly block legitimate users accessing your site from behind a shared NAT (e.g., corporate offices, datacenters, mobile networks). Rate limiting is a surgical tool that must be applied only to specific, sensitive locations (e.g., /login, /api/v1/authenticate) where abuse is likely. Incorrectly configured rate limits are a common source of user complaints and support tickets.

Audit Procedure

This is a manual check requiring context.

1. Run the following command to find rate-limiting rules:

nginx -T 2>/dev/null | grep -E '^\s*(limit_req_zone|limit_req)'

2. Manually evaluate the findings:

• Is a limit_req_zone defined in the http block?
• Important, where is applied? Is it applied globally ( Block or )? This is a high risk. Or is it applied to specific endpoints like ? Which is best practice.