From the documentation of ngx_http_limit_conn_module:

>In HTTP/2 and SPDY, each concurrent request is considered a separate connection.

So is there a way limit HTTP/2 connections, not requests?

Also, doesn't this mean an attacker can establish any number of concurrent connections?