3 ms·
For sites that don't serve large files, option #4, disabling the range header, is the simplest option. Note that this means that downloads are not resumable, w
by chalst 15y ago
For sites that don't serve large files, option #4, disabling the range header, is the simplest option.
Note that this means that downloads are not resumable, which can easily annoy site users even if there is no multimedia involved. You only need to specify one range in the header in this case, but to do that you need option #1.
- ck2 15y agoI guess you could just allow ONE range which seems like a good compromise and defeat the attack? RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,1}$|^$) RewriteRule .* - [F] (for those that don't speak regex: the 0,1 allows either one or none range headers to be accepted, more or less will fail to be served anything) That will allow downloads to still resume and it works in any version of apache.
- Dylan16807 15y agoIf you want to limit to one then ? is simpler. Doesn't that version limit to 1+0-1 -> 1-2 though? But why bother with a complex anchored regex when you can just search for "," in the range header.
- epo 15y agoOr just Apache's Option 1 as in your post above?