Open silence-coding opened 3 years ago
Even if the server implements idle timeouts, an attacker can simply send the data very slowly (slowloris attack).
Although this capability cannot solve slow attacks, when the connection is idle for a long time, it is necessary for the hyper server to close the connection.
Should we add idle timeout for the server? Without idle timeout, the service cannot quickly release idle connections. In this case, the client can set up a large number of idle connections with the hyper server, exhausting the hyper resources.