From: Yohanes Santoso <ysantoso-rubytalk@...>
Date: 2005-10-24T13:50:08+09:00
Subject: Re: I want my MOM

"Zed A. Shaw" <zedshaw@zedshaw.com> writes:

> 3)  Specify that the first line is never longer than X bytes.  This is
> important as a classic DOS attack is to "trickle" characters forever
> never giving the \n.  If you explicitly state that it can't be longer
> than say 128 characters then servers can boot bad clients quick.
> 4)  The SIZE of the header specifies the exact length, and removes the
> need for the \n\n separator.  This is also important because I can boot
> a client that tries to send more than SIZE or that says it's going to
> send a SIZE that I don't want.  This prevents another attack where I
> just trickle header lines until the server croaks.
> 5)  Require that the header MUST have the content-length settings.  This
> is again to make sure that requests which are too large are always
> booted.  Making this optional just leaves open an attack where you
> again slam the server with never ending data until it dies.  This also
> makes it very clear how the content is always sent and leaves nothing
> open for debate.

To add to what Zed's said:

Servers can always prevent trickle attack by specifying a
timeout. Without any timeout from server, a client would always be
able to tie up unnecessary resources (IP port, for example).

Most HTTP/1.1 servers close idle persistent connection after 2 minutes
of inactivity.

Again, server implementations should employ some sort of timeout
mechanism. That's just the right thing to do.

YS.