basic timeout on requests about tiny_httpd HOT 8 CLOSED

https://en.wikipedia.org/wiki/Slowloris_(computer_security) coucou

from tiny_httpd.

I submitted a pull request #23 that probably address this

from tiny_httpd.

For slowloris we'd need to also realize that a given query has started more than n seconds ago and isn't parsed yet, a mere timeout doesn't suffice (the client just adds a new fake header every 10 seconds or so).

from tiny_httpd.

I was trying to make my server usable by firefox which it was not with 20 simultaneous access or I would have needed much more max_connections.

Strangly, firefox is creating new connection except when connection is refused, then it tries to reuse old ones. But
when max_connections is reached problem starts ... I saw up to 10 connections for one client with firefox,
most of them unused.

For protection agains DDOS attack, I do not see how to recognize fake request, this is probably undecidable ;-).
A protection agains DDOS is probably to allow a maximum of request by second. But if the attacker has 1000 machines or more,
this seems very hard.

from tiny_httpd.

This is solved ?

from tiny_httpd.

If you think so, it can be closed :)

from tiny_httpd.

The socket timeout seems to work. I tested it with very short timeout and it was ok.
The only question is do we want a (long) timeout by default ? It the defaut usage of a server written with
Tiny_httpd is behind a proxy (apache or nginx) better have no timeout.

from tiny_httpd.

I think a default of no timeout is good.

from tiny_httpd.