4

When I say drop connection I mean actually closing the socket without reading any more bytes. I am trying to prevent a DoS attack where the attacker is trying to make a lot of HTTP requests that upload very very large files. For my purpose, I will consider any client trying to upload file larger than a pre-configured amount as attacker, and I would like to terminate the connection ASAP without reading even single more byte (I would like to send a HTTP 413 back to client if possible, but I don't care if the client receive the response or not, I just don't want any more byte from the client).

I have a app that runs within Jetty and from what I observed even if I throw exception, Jetty itself will still consume all the request body (and drop them) as part of the HTTP request life cycle.

So how do you guy do that? Through Jetty itself or through some kind of reverse proxy?

I know about maxFormContentSize and Apache File Upload, but they don't really do what I am looking for.

Alvin
  • 10,308
  • 8
  • 37
  • 49
  • `maxFormContentSize` doesn't do what you're looking for why? – user207421 Sep 15 '16 at 04:01
  • @EJP because it doesn't work with multi part and all it does is throw `IllegalStateException` and the Jetty contain will still consume and discard all the bytes upon catching the exception. – Alvin Sep 15 '16 at 04:04

0 Answers0