Re:The novel HTTP/2 'Rapid Reset' DDoS attack
by jsnell on Tuesday October 10, 2023 @03:27PM
(#37836371)
For most current HTTP/2 implementations it'll just be ignored, and that is a problem. We've seen versions of the attack doing just that, as covered in the variants section of the article.
Servers should switch to closing the connection if clients exceed the stream limit too often, not just ignoring the bogus streams.
Servers should switch to closing the connection if clients exceed the stream limit too often, not just ignoring the bogus streams.