How to protect an API from brute force attacks through Nginx rate limiting?

To protect an API from brute force attacks through Nginx, you can use the rate limiting module, which restricts the number of requests from a single client over a certain period of time.

Example configuration:

http {
    # Define a zone to store limit state
    limit_req_zone $binary_remote_addr zone=one:10m rate=10r/m;

    server {
        location /api/ {
            limit_req zone=one burst=5 nodelay;
            proxy_pass http://backend;
        }
    }
}

Here:

• limit_req_zone sets a limit of 10 requests per minute per client IP address.
• burst=5 allows exceeding the limit temporarily by 5 requests.
• nodelay disables delay when exceeding the burst.

This effectively limits request speed and makes brute-force attacks more difficult. For more complex scenarios, it can be combined with blocking by User-Agent, IP, using fail2ban, and other tools.