akka/akka-http

Consider implementing "time to receive request" timeout on server-side

Open

#813 opened on Jan 24, 2017

View on GitHub
 (7 comments) (2 reactions) (0 assignees)Scala (598 forks)batch import
1 - triagedhelp wantedt:core

Repository metrics

Stars
 (1,311 stars)
PR merge metrics
 (Avg merge 1d 10h) (2 merged PRs in 30d)

Description

This is different than the request timeout or the idle timeout.

This is about a timeout that counts from beginning of a request being incoming, to the moment in time when the request is done streaming in. This is to mitigate slowloris style attacks,

Details here:

Contributor guide

Research direction
Investigate how Akka HTTP currently handles request timeouts and idle timeouts. Propose a new timeout that starts when the request begins arriving and expires when the request is fully received. Consider integration with existing timeout config and impact on slowloris mitigation.
Tech stack
None
Domain
backendsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
HTTPThreading
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30