Mitigate slow read attacks

[nateberkopec]

There are two non-mutually-exclusive paths forward:

• Mitigate slow read attacks by putting responses in the Reactor loop.
• Mitigate slow read attacks through other means, e.g. limits on connection lifetime, limits on acceptable window sizes

There's a tool for reproducing this attack (and some other great info) here https://github.com/shekyan/slowhttptest/wiki

[johnnyshields]

Is this attack possible even if Puma is behind Nginx?

[stevenharman]

@johnnyshields Assuming you've got nginx configured with proxy_buffering on, then you're probably fine. Similar if you're on Heroku as the Heroku Router will buffer up to 1MiB of response for you. There's a longer discussion of this issue too.

[MSP-Greg]

Also, https://blog.qualys.com/vulnerabilities-threat-research/2012/01/05/slow-read