Hello!

On Mon, Jan 27, 2014 at 03:42:26PM -0800, Piotr Sikora wrote:

> Hey Valentin,
>
> > Current receiving flow control implementation is pretty simple and effective:
> > we allow browser to send as much data as it wants. That's why it is hardcoded
> > to the maximum value.
> >
> > (...)
> >
> > No, it's actually browser's will to properly prioritize POST requests.
>
> But now you're relying on the browser to do the right thing vs forcing
> the correct behavior via SPDY's flow control.
>
> > The receiving flow control has two uses for server:
>
> I'd argue that making sure that requests are multiplexed is also a
> valid use case ;)
>
> In any case, I'd prefer if this would be configureable value.
>
> Also, it seems that we should be forcing minimum value for the
> client's window size, otherwise client can set window size to 2 bytes
> and make nginx return thousands of DATA frames and use way too many
> resources to serve a small static page (same is true for Google's &
> Twitter's web servers). This could be a huge (D)DoS-vector.

It's believed that SPDY is a huge DDoS vector by itself.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel