4 ms·
Beware though -- nginx 444 doesn't actually close the connection. At the packet level, it just does not respond. This distinction is important if you have a lo
by quesera 4y ago
Beware though -- nginx 444 doesn't actually close the connection. At the packet level, it just does not respond.
This distinction is important if you have a load balancer in front of nginx. The LB will wait until timeout for a response, occupying a bit of stateful memory and probably causing an error which is indistinguishable from "backend application server is offline".
- treffer 4y agoThat is actually cool, it is a tarpit for these bots! On a well configured site the LB timeouts should be short enough anyway. But it is a risk, especially on classic DOS attacks.
- quesera 4y agoYep it's great for tarpitting if you are not behind an LB. The other problem, if you are behind an LB, is that the client (DoS attacker) will get a 503 from the LB after timeout. So, no gain even if your timeouts are reasonable. It'd be great if you could return a custom response from nginx that would tell the LB to drop the request -- or you could move the exploit-detection logic to the LB instead of nginx, and the LB could do its own 444 equivalent.