title: How to mitigate Slowloris in Node.js?
body: <p><strong>Update</strong></p>
  <p>_ <a href="https://nodejs.org/pt-br/blog/vulnerability/february-2019-security-releases/" rel="nofollow noreferrer">https://nodejs.org/pt-br/blog/vulnerability/february-2019-security-releases/</a> _.</p>
  <p><strong>Update Friday, 13th 2018:</strong></p>
  <p>I managed to convince the Node.js core team about setting a CVE for that.</p>
  <p>The fix — new defaults and probably new API — will be there in 1 or 2 weeks.</p>
  <p><br><hr></p>
  <br>
  Mitigate means to quiet an attack.
  <br><br>
  <p>Everybody knows Slowloris:</p>
  <p><code>HTTP Header</code> or <code>POST Data</code> characters get transmitted slowly to block the <code>socket</code>.</p>
  <p>Scaled that makes a much easier DoS attack.</p>
  <br>
  **In NGINX the mitigation is inbuilt:**
  > Closing Slow Connections<br><br> 
  > You can close connections that are writing
  > data too infrequently, which can represent an attempt to keep
  > connections open as long as possible (thus reducing the server’s
  > ability to accept new connections). Slowloris is an example of this
  > type of attack. The client_body_timeout directive controls how long
  > NGINX waits between writes of the client body, and the
  > client_header_timeout directive controls how long NGINX waits between
  > writes of client headers. The default for both directives is 60
  > seconds. This example configures NGINX to wait no more than 5 seconds
  > between writes from the client for either headers or body.
   
  https://www.nginx.com/blog/mitigating-ddos-attacks-with-nginx-and-nginx-plus/
  <br><br>
  <p>Since there is no inbuilt way to work on the <code>header</code> in the <code>HTTP Server</code> in <code>Node.js</code>.</p>
  <p>I came to the question, if I can combine <code>net</code> and a <code>HTTP Server</code> for mitigating <code>Slowloris</code> .</p>
  <br>
  The idea to `destroy` the `connection` in case of `Slowloris` is this.
  <br>
  <br>
  <pre><code>http.createServer(function(req, res) {
      var timeout;    
      net.on('data', function(chunk) {
          clearTimeout(timeout);
          timeout = setTimeout(function() {
              req.connection.destroy();
          }, 100);
      };   
  };
  </code></pre>
  <br>
  <p>The problem I can see is, both services have to listen on the same <code>Socket</code> on <code>Port 80 and 443</code>.</p>
  <p>Do — not — know how to tackle this.</p>
  <p><br><br>
  It is possible to transfer requests and responses from <code>net</code> to <code>HTTP-Server</code> and back.</p>
  <p>But this takes 2 <code>sockets</code> for 1 incoming message.</p>
  <p>And 2 <code>sockets</code> for 1 outgoing message.</p>
  <p>So this is — not — feasible in sense of high available server.</p>
  <p>I have no clue.</p>
  <p>What can the world do to get rid of this scourge?</p>
  <p><br><br>
  <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5568" rel="nofollow noreferrer">CVE for Apache Tomcat.</a></p>
  <p><br><br>
  This is a serious security threat.</p>
  <p>I think this want to be solved on <code>C</code> or <code>C++</code> base.</p>
  <p>I cannot write these real programmer languages.</p>
  <p>But all of us are helped, if somebody pushes this on Github.</p>
  <p>Because the community there once deleted my thread about mitigating Slowloris.
  <br><br></p>