socketry / falcon

A high-performance web server for Ruby, supporting HTTP/1, HTTP/2 and TLS.
https://socketry.github.io/falcon/
MIT License
2.54k stars 79 forks source link

upstream hijacking, streamed uploads #203

Closed pschrammel closed 1 year ago

pschrammel commented 1 year ago

Hi, I try to implement a streaming upload (imagine implementing s3 in ruby). But unfortunately most web servers don't support this (I opened a discussion in puma but didn't get far: https://github.com/puma/puma/discussions/3100). From what I read so far for falcon this should be quite natural (even if not rack compliant). So:

Is there a way to have only the headers parsed and pass the request stream to the application so it can do some body parsing on it's own (chunked upload to s3/dropbox....).

ioquatix commented 1 year ago

This behaviour is complaint with Rack 2 and Rack 3.

Puma buffers the input body to prevent slow client attacks because it has a limited worker pool and it's fairly easy to tie up all workers with slow requests.

Falcon can create an unbounded (but memory/cpu limited) number of fibers so it's less susceptible to these kinds of attacks but it's still a possibility. We will introduce more advanced mechanisms to protect against this kind of attack in the future too.

In the case of Falcon, env['rack.input'] is streamed directly from the client, so you can read from that and do whatever you want with it. It behaves similar to an IO object.

pschrammel commented 1 year ago

great...I'll try to contribute an example ASAP for the future readers.