title: Why Nginx rate limit is not rejecting exceeded requests?
body: <p>This is my nginx configuration:</p>
  <pre><code>{
      # on top of conf file
      limit_req_zone $binary_remote_addr zone=main:10m rate=1r/s;  
      ...
  
      location /login {
              limit_req zone=main burst=3 nodelay;
              ModSecurityEnabled on;
              ModSecurityConfig /usr/local/nginx/conf/modsecurity.conf;
              proxy_pass http://localhost:4000;
              proxy_http_version 1.1;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection 'upgrade';
              proxy_set_header Host $host;
              proxy_cache_bypass $http_upgrade;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      }
  
  }
  </code></pre>
  <p>When hitting the api url (http://localhost:4000/login) multiple times using following code -</p>
  <pre><code>for i in {0..2000}; do (curl -Is http://localhost:4000/login | head -n1 &amp;) 2&gt;/dev/null; done
  </code></pre>
  <p>I am getting always getting 200 response code instead of getting 503 for some requests which should be rejected. Why is this happening?</p>