Paolo Insogna
Paolo Insogna
Node.js Core Member, Staff Developer Experience Engineer at NearForm, Polyglot Full-Stack Expert. RPG and LARP addicted and nerd on lot more.
Node Congress 2023Node Congress 2023
29 min
The tale of avoiding a time-based DDOS attack in Node.js
Web applications are commonly vulnerable to several Distributed Denial of Service attacks, sometimes in unexpected ways. An example is the SlowLoris attack, an exploit that leads to service interruption by simply sending the data to the server as slowest as possible.  In this talk I will tell the tale of how it took almost 13 years for Node to be completely protected by SlowLoris attack. I will also show that sometimes prioritizing performance can lead to incorrect fixes that can result in a false sense of protection.