One of the biggest security challenges that companies face in today’s modern climate is the POST attack. Unlike a more traditional “Denial-of-Service” attack, POST attacks target a server's logical resources – making them particularly powerful when executed.

What is a Slow POST Attack?

In a Slow POST attack, an attacker begins by sending a legitimate HTTP POST header to a Web server, exactly as they would under normal circumstances. The header specifies the exact size of the message body that will then follow. However, that message body is then sent at an alarmingly low rate – sometimes as slow as 1 byte per approximately two minutes.

Because the entire message is technically correct and complete, the targeted server attempts to obey all specified rules – which as you would expect, can take quite a while. The issue is that if an attacker were to establish hundreds or even thousands of these POST attacks simultaneously, it will quickly use up all server resources and make legitimate connections impossible.

How Can HAProxy Protect Against Slow POST Attacks?

Because POST attacks can be incredibly powerful, it’s always important to have a tool in place to identify these types of issues when they’re still in their nascent stages to prevent them from becoming much larger, more serious issues down the road.

Because HAProxy was designed as an application delivery controller to manage high availability and performance, it is already in an ideal position to stop these types of POST attacks in its tracks.

Related Blogs:

HAProxy HTTP POST Attacks Configuration Guide

Because of HAProxy’s structure and configuration flexibility, many professionals and consumers alike often use it as a security tool. Case in point: by using the following configuration example, you can easily help protect your servers against POST attacks to prevent attackers from clogging resources and ultimately harming the well-being of not only your equipment but your entire organization at the same time.

frontend ft_myapp
 [...]
 option http-buffer-request
 timeout http-request 10s

As you can see, with just a few simple modifications, HAProxy can quickly and effortlessly remove POST attacks from the list of things you have to worry about on a daily basis with regard to your mission-critical business applications and API.

The option http-buffer-request instructs HAProxy to wait for the whole DATA before forwarding it to a server and the timeout http-request 10s option tells how much time HAProxy lets a client send the whole POST.

Thanks to its functionality as a security tool, a reverse proxy, and more in addition to its intended functionality as a load balancer, it’s easy to see why HAProxy is used by some of the largest sites on the Internet including Reddit, Tumblr, GitHub and more on a daily basis.

This function is available in the following versions of HAProxy:

Subscribe to our blog. Get the latest release updates, tutorials, and deep-dives from HAProxy experts.