Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add blacklist headers to protect against DoS attack #1647

Open
bytehope opened this issue Sep 12, 2023 · 0 comments
Open

Add blacklist headers to protect against DoS attack #1647

bytehope opened this issue Sep 12, 2023 · 0 comments

Comments

@bytehope
Copy link

Hello, I have tried everything to contact the maintainers, nobody answer to me, there is my last try.

  1. There is populate headers into outgoing request from incoming:
    https://github.com/http-party/node-http-proxy/blob/master/lib/http-proxy/common.js#L43

  2. if then add Trailer header with any value into the incoming request, that header will be handled by the internal nodejs http lib. For a GET-request, processing that header will trigger unhandled error ERR_HTTP_TRAILER_INVALID. https://github.com/nodejs/node/blob/38cc53845307fdb81dd50cfb7bcfc8c7b83b947c/lib/_http_outgoing.js#L538

  3. An unhandled error will cause nodejs shutdown.

If any other project uses node-http-proxy package and just proxy any "user" request, all of them are vulneranilty to DoS attack

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant