3 ms·
The attacker just needs to work out the average size of the normal response, then the average size of the response with the extra character. Send enough request
by anon1385 13y ago
The attacker just needs to work out the average size of the normal response, then the average size of the response with the extra character. Send enough requests and the difference will be noticeable. It slows them down, but doesn't fix the problem.