#4891 defect new
twisted.web.http does not throttle pipelined requests
|Reported by:||ivank||Owned by:||Indradhanush Gupta|
twisted.web.http loads an unlimited amount of pipelined HTTP requests into memory, even when it is busy processing. This allows for a very easy DoS attack.
My suggestion is to call
.pauseProducing() on the underlying transport when there are 8 pipelined requests queued, and
.resumeProducing() when there are fewer.
Note that even browsers may send as many concurrent pipelined requests as they want to (Opera for example has no limit).
Change History (13)
comment:5 follow-up: 6 Changed 4 years ago by
|Owner:||set to Indradhanush Gupta|