Slowloris

Slowloris is an attack tool and technique that opens many connections to a web server and sends partial HTTP requests, adding a header line every few seconds. The server keeps each connection reserved while it waits for the request to finish.

Why it matters

It does not need much bandwidth. A single machine can tie up a server with a limited worker or connection pool, such as a default Apache prefork setup, so legitimate users cannot connect. Servers that handle connections asynchronously, like nginx, and CDNs or proxies in front of the origin are generally more resilient, but request header and body timeouts still matter.

Example

Limit how long a client may take to send headers and bodies. In nginx:

client_header_timeout 10s;
client_body_timeout   10s;
limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_conn perip 20;

For Apache, the mod_reqtimeout module can enforce minimum data rates for the request. Symptoms include many connections in ESTABLISHED from a few IPs and low CPU use while the site is unresponsive.

Common mistakes

• Setting generous header timeouts for the sake of slow mobile clients.
• Exposing the origin directly rather than behind a proxy or CDN.
• Diagnosing by CPU alone, which stays low during this attack.

Related

• Request timeout
• Idle timeout
• Port exhaustion
• Guide: DDoS basics

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.