Challenge 1: Rate Limiting the /login Endpoint — Solution Walkthrough

The configuration:

  limit_req_zone $binary_remote_addr zone=login_limit:10m rate=5r/s;

  location /login {
      limit_req zone=login_limit burst=10 nodelay;
  }

Why this works:

limit_req_zone defines a zone named login_limit, keyed on client IP
via $binary_remote_addr, capped at a steady rate of 5 requests per
second — matching the specified limit exactly. Inside the /login
location, limit_req references that zone, with burst=10 allowing up
to 10 requests above the steady rate to be absorbed rather than
immediately rejected, and nodelay processing those burst requests
right away instead of queuing them with an added delay, per the
requirement that they be "processed without added delay."

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise is a direct, hands-on application of this chapter's own
limit_req_zone/limit_req example to a new specific rate and burst
value, correctly including nodelay since the requirement explicitly
asked for burst requests to be processed without delay rather than
queued.