Boring a server to death - The Slow Loris Attack

I found this article by @alvises that seems to shed some light in the settings that we can tweak:

From the version 1.4, Phoenix uses Cowboy 2 which has a new set of timeout options:

  • request_timeout ( default 5_000 milliseconds ), *Time in ms with no requests before Cowboy closes the connection.
  • This is the maximum time, in which the client has to send the HTTP request. We do not touch this.
  • inactivity_timeout ( default 300_000 milliseconds ), Time in ms with nothing received at all before Cowboy closes the connection .
  • idle_timeout ( default 60_000 milliseconds ), Time in ms with no data received before Cowboy closes the connection .
5 Likes