Phoenix API latency > 30s

[Exadra37]

@josevalim

There is a DDoS attack called Slowlloris which is exactly about opening many connections to the server and then slowly writing to the socket, slowly enough to not being disconnected, and keeping everything busy.

For anyone wanting a little more details on it:

Boring a server to death - The Slow Loris Attack

I found this article by @alvises that seems to shed some light in the settings that we can tweak: From the version 1.4, Phoenix uses Cowboy 2 which has a new set of timeout options: request_timeout ( default 5_000 milliseconds ), *Time in ms with no requests before Cowboy closes the connection. This is the maximum time, in which the client has to send the HTTP request. We do not touch this. inactivity_timeout ( default 300_000 milliseconds ), Time in ms with nothing received at all befor…