pjfanning opened a new pull request, #1194: URL: https://github.com/apache/pekko-http/pull/1194
The idle-timeout does catch completely idle connections, but an attacker sending one byte per second would keep the connection alive indefinitely since data is flowing. The request timeout only starts after the entity is complete. The real mitigations users can apply: - Lower idle-timeout for untrusted clients - Use max-content-length to bound total entity size - Add a reverse proxy (nginx, etc.) that has its own slowloris protections Adding a per-entity receive timeout to the framework would be a significant feature. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
