Mitigating slow HTTP headers vulnerability

[Amit Pande <Am...@veritas.com>]

(My apologies if this has been discussed already.)

Slow HTTP headers vulnerability was reported by scanner tool, on Tomcat 8.5.54.

There might be not any perfect solution to address this issue, but wanted to understand some of the best practices to mitigate this vulnerability.

https://stackoverflow.com/questions/49442855/mitigating-slow-http-post-vulnerability-on-tomcat-8

Some recommendations from above link seem reasonable ("We reduced the connectionTimeout="8000" and scan is passed" - This didn't sound very convincing, though).  Is there anything more than can be done to address this?

We're trying to avoid putting reverse proxy in front of Tomcat as we do have our own pass-through proxy but it doesn't have any special capabilities to avoid this vulnerability like some reverse proxies (e.g. ngnix) have.

Appreciate the inputs here.

Thanks,
Amit

Re: Mitigating slow HTTP headers vulnerability

[Mark Thomas <ma...@apache.org>]

On 09/06/2020 07:19, Amit Pande wrote:
> (My apologies if this has been discussed already.)
> 
> Slow HTTP headers vulnerability was reported by scanner tool, on Tomcat 8.5.54.
> 
> There might be not any perfect solution to address this issue, but wanted to understand some of the best practices to mitigate this vulnerability.

Use the Servlet Async and non-blocking I/O API to read the POST. That
way no (well very few) server resources are used unless there is data to
be read. If you wish you can add checks to your code for abuse (e.g.
check upload speed) and drop potentially abusive connections.

If you want a purely Tomcat configuration based approach then reducing
timeouts is about all you can do.

Mark

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org