hyperium / hyper

An HTTP library for Rust
https://hyper.rs
MIT License
14.57k stars 1.6k forks source link

add conn_idle_timeout for server #2355

Open silence-coding opened 3 years ago

silence-coding commented 3 years ago

Should we add idle timeout for the server? Without idle timeout, the service cannot quickly release idle connections. In this case, the client can set up a large number of idle connections with the hyper server, exhausting the hyper resources.

CodesInChaos commented 3 years ago

Even if the server implements idle timeouts, an attacker can simply send the data very slowly (slowloris attack).

silence-coding commented 3 years ago

Although this capability cannot solve slow attacks, when the connection is idle for a long time, it is necessary for the hyper server to close the connection.