Re:Cache Poisoned DoS Attack: Shutdown any CDN Website with ...
by elmo2you on Tuesday October 22, 2019 @04:22PM
(#21328136)
Could you maybe provide a practical example of such a "heavy to process" 404? I'm having difficulty to image how a "Not Found" could (or ever should) involve heavy processing. AFAIK, a 404 should be only given for a non-existing resource (e.g. file). That should be straightforward enough. Granted, I've seen some horrible semantic resource pointers/paths in URI's over the years, some of which requiring processing, and some of them generating 404s. However, such contortions are mostly just a testament to horribly bad design. If the request involves processing on the server side (higher up than the web server or cache itself), resulting in a conclusion that a resource is unavailable, should that not return a 5xx response?
[ Parent
| on HN ]
Re:Cache Poisoned DoS Attack: Shutdown any CDN Website with ...
by iMerNibor on Tuesday October 22, 2019 @05:00PM
(#21328466)
"We couldn't find /<requested-page>, were you maybe looking for one of these similar pages? <list>" is something that I've seen before
Re:Cache Poisoned DoS Attack: Shutdown any CDN Website with ...
by Dylan16807 on Tuesday October 22, 2019 @04:59PM
(#21328463)
The origin server might be set up to serve everything through cgi. That would mean loading the entire framework just to spit out a 404 for the favicon. If all the other pages cache just fine, you could hit 100% load on favicons when you'd otherwise be at 10%.
It's not an ideal design but I wouldn't call it 'horrible'.
Re:Cache Poisoned DoS Attack: Shutdown any CDN Website with ...
by iliketoworkhard on Wednesday October 23, 2019 @01:34PM
(#21336879)
What is CGI in this context? I’ve only heard of it in a movie special effects context.
Re:Cache Poisoned DoS Attack: Shutdown any CDN Website with ...
by Dylan16807 on Wednesday October 23, 2019 @03:34PM
(#21338032)
The web server having to run an external program to handle the request, typically because it's written in a scripting language.
Technically it stands for "common gateway interface" but that doesn't come up very much.
Re:Cache Poisoned DoS Attack: Shutdown any CDN Website with ...
by parliament32 on Wednesday October 23, 2019 @03:29PM
(#21337988)