search

NancyFx / Nancy

Lightweight, low-ceremony, framework for building HTTP based services on .Net and Mono
http://nancyfx.org
MIT License
7.16k stars 1.47k forks source link

Is it safe to self host nancy and open to the internet? #2984

Open NateKomodo opened 4 years ago

NateKomodo commented 4 years ago

Is it safe to put a nancy self hosted server into production and internet facing (Behind cloud flare of course)?

Also, whats the effect of slowlorris or similar attacks on nancy? i read the maximum connection count was determined as half the logical core count, which seems like it could be flooded easily with slowlorris connections.

cocowalla commented 4 years ago

You haven't stated how you plan to self-host (i.e. HTTP.sys or Kestrel), but in either case, nancy is really not the relevant factor here - it's the HTTP server. HTTP.sys has long been considered production-ready, and Kestrel is also considered production-ready now.

DISCLAIMER: Not a Nancy maintainer, just a Nancy user.

NateKomodo commented 4 years ago

You haven't stated how you plan to self-host (i.e. HTTP.sys or Kestrel), but in either case, nancy is really not the relevant factor here - it's the HTTP server. HTTP.sys has long been considered production-ready, and Kestrel is also considered production-ready now.

DISCLAIMER: Not a Nancy maintainer, just a Nancy user.

Is the default in nancy http.sys?

cocowalla commented 4 years ago

It really depends what precisely you are doing, and what framework you are targeting.