Rate limiting does not work after 3xx redirect

[KyleN]

Rate limiting is ignoring completely if a 3xx redirect occurs. Creates a large problem for the limit_req module. As the module is effectively bypassed when endpoints are accessed in this fashion.

This issue is extremely easy to reproduce.

1. Setup your limit_req directives:

limit_req_zone $binary_remote_addr zone=limit_one:10m rate=10r/m;
limit_req zone=limit_one burst=20 nodelay;
limit_req_status 429;

2. Access the limit from a server block which performs a 301 redirect, such as going from HTTP to HTTPS.

server {

if ($host = www.test.com) {

return 301 ​https://$host$request_uri;

} # managed by Certbot

if ($host = test.com) {

return 301 ​https://$host$request_uri;

} # managed by Certbot

listen 80;
server_name test.com www.test.com;
return 404; # managed by Certbot

}

3. You can hit the endpoint without any consequences.

[Maxim Dounin]

That's expected behaviour. That's because instructions of the rewrite module are executed while ​selecting configuration to use, and hence before any access checks or limits are applied.