DOS Attack on incomplete requests ASP.NET

Asked Feb 23 '16 at 15:56

Active Feb 23 '16 at 16:45

Viewed 173 times

I have an application that gets DOSed if it received incomplete/slow http requests. I debugged and found the reason to be that when I try to access the HTTP Request, the application stalls until the request is complete. I need a way to tell me in the Request is complete or not. something like Request.IsComplete()

EDIT

Example:

    protected void Application_BeginRequest()
    {
         Log(Request["Query"]);
    }

The request tries to get Request[Query] forever.

I created a client that can be abstracted as below

        socket.Connect(uri.Host, uri.Port);
        SendRequest(socket, uri, payload, bytesToTruncate);
        socket.Close();

If I go in debug mode, after SendRequest(), The request goes into Application_BeginRequest() before socket.Close() is called, but I will not be able to access Request["Query"] in Application_BeginRequest until socket.Close() is called. It basically stops and waits for the socket.Close/Request to be complete

edited Feb 23 '16 at 16:45

Jamie Rees

7,973
2
45
83

asked Feb 23 '16 at 15:56

blenddd

1

Please show how you "access the HTTP request". I don't think http.sys forwards requests before they're complete. Edit: nevermind, it does that. – CodeCaster Feb 23 '16 at 15:58
1

Give us a minimal complete verifiable example that reproduces this issue (you can even do it by showing us an action that sets a timer and doesn't return until that timer is done); so that we can be sure your code isn't the issue. – George Stocker Feb 23 '16 at 15:58
Can you post the code responsible for the stall? – bastos.sergio Feb 23 '16 at 15:59
Edited with more insights of what's happening. I hope you understand the problem now – blenddd Feb 23 '16 at 16:06
What does `Log` refer to? – George Stocker Feb 23 '16 at 16:42
Any operation that's happening, it's actually irrelevant here since the code never gets past Request["Query"] – blenddd Feb 23 '16 at 16:43

DOS Attack on incomplete requests ASP.NET

0 Answers0