News for hackers. Stuff that matters.

A comment on The novel HTTP/2 'Rapid Reset' DDoS attack. Parent comment

Re:The novel HTTP/2 'Rapid Reset' DDoS attack by blauditore on Tuesday October 10, 2023 @03:22PM (#37836292)
What happens if you send more? Does it just get ignored by the server?
[ Parent | on HN ]
Re:The novel HTTP/2 'Rapid Reset' DDoS attack by jsnell on Tuesday October 10, 2023 @03:27PM (#37836371)
For most current HTTP/2 implementations it'll just be ignored, and that is a problem. We've seen versions of the attack doing just that, as covered in the variants section of the article.

Servers should switch to closing the connection if clients exceed the stream limit too often, not just ignoring the bogus streams.

[ Parent | on HN ]