-
Notifications
You must be signed in to change notification settings - Fork 29
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Imeplement maximum request size validation #17
Comments
Of what I know (or always do) http-frameworks should always behind a reverse-proxy such as nginx / apache as these are much faster and efficient in handling requests. Nginx for example comes with a I don't thing java-express should ever (together with express) be directly exposed, there are way too many ways to attack a server and DDOS is just the most popular one. For example I don't know how or if Javas http server has anything against slow loris attack which we couldn't prevent without implementing the whole http server on our own, the same counts for a whole set of security / caching / response handling mechanism implemented in reverse-proxy servers or these which are specialized in just handling and forwarding requests to an endpoint. Java-express should only take care of security if it directly affects a part of the framework and not re-invent the wheel of a webserver (but instead serve as way to easily implement APIs in Java). But that's just me and I have no idea how people work with java in production, what do you think or how would you handle that? |
Overview
We need some sort of measure to prevent attacks based on huge HTTP request payloads.
@simonwep , would you suggest any particular configuration class to implement this feature?
We could probably implement this as a Middleware extension.
The text was updated successfully, but these errors were encountered: