3 ms·
Another relatively safe strategy : Don't buffer http data on server. Read a limited sized header and then stream the body to its request handler.
by habibur 4y ago
Another relatively safe strategy : Don't buffer http data on server. Read a limited sized header and then stream the body to its request handler.
- saurik 4y agoRight: like, the entire concept of to_bytes is in a very real sense a dangerous anti-pattern that only feels necessary because so many of our other APIs are so difficult to use on streams.
- masklinn 4y agoThat's not necessarily better as it's sensitive to slowloris attacks, and the handler might not work with streams either, or could just read it all in memory anyway, so you're just moving the problem around. Hell, a streaming consumer which doesn't require and check the content-length might even spin forever on CPU if a malicious client keeps sending data.