Intermediate LevelNode JS
How do you configure server.headersTimeout and server.requestTimeout to prevent Slowloris DDoS attacks?
❓ Interview Prompt: Slowloris attacks send HTTP headers 1 byte at a time every 10 seconds, keeping sockets open until server crashes. Set server.headersTimeout = 5000 (5s) and server.requestTimeout = 30000 to drop stalling connections.
A Slowloris DDoS attack sends HTTP request headers extremely slowly (1 byte every few seconds), keeping server TCP sockets open until available connection pools crash!
Defense Configuration:
Set strict server timeout limits:
•
'server.headersTimeout': Max time (ms) allowed for receiving complete HTTP headers (e.g. 5000ms).
•
'server.requestTimeout': Max time allowed for receiving complete request payload.
Code Implementation Example
javascript
import http from 'node:http';
const server = http.createServer((req, res) => res.end('OK'));
// Defend against Slowloris DDoS attacks!
server.headersTimeout = 5000; // 5 seconds max for headers
server.requestTimeout = 30000; // 30 seconds max for full request
server.listen(3000);💡Configuring server timeouts to defend against Slowloris DDoS attacks.
🎯 Interview Key Takeaway
Set server.headersTimeout and server.requestTimeout to drop stalling HTTP connections and prevent Slowloris DDoS attacks.
#headersTimeout#Slowloris#Security#DDoS Defense#Intermediate
Back to all Node JS Questions→