HTTP Slow Post and IIS settings to prevent

security iis web iis-8
M Raymaker picture M Raymaker · Jan 25, 2016 · Viewed 13.2k times · Source

So we got this report from a Security Company saying our MVC website running on IIS 8.0 was vulnerable to slow HTTP post DoS attack. The report stated we should

  • Limit request attributes is through the <RequestLimits> element, specifically the maxAllowedContentLength, maxQueryString, and maxUrl attributes.
  • Set <headerLimits> to configure the type and size of header your web server will accept.
  • Tune the connectionTimeout,
    headerWaitTimeout, and minBytesPerSecond attributes of the <limits>
    and <WebLimits> elements to minimize the impact of slow HTTP attacks.

The trouble is I'm having a hard time finding any recommendations on how these values should be set. Eg. the minBytesPerSecond is default 240, but what should it be to prevent SlowHTTPPost attacks?

Cheers Jens

Answer

M Raymaker picture M Raymaker · Feb 1, 2016

So, ended up following this guy's recommendations:

http://cagdasulucan.blogspot.se/2013/02/iis-recommendations-against-slow-http.html

Related questions

How to create .pfx file from certificate and private key?

I need .pfx file to install https on website on IIS. I have two separate files: certificate (.cer or pem) and private key (.crt) but IIS accepts only .pfx files. I obviously installed certificate and it is available in certificate …

Read More
What are all the user accounts for IIS/ASP.NET and how do they differ?

Under Windows Server 2008 with ASP.NET 4.0 installed there is a whole slew of related user accounts, and I can't understand which one is which, how to they differ, and which one is REALLY the one that my app runs under. …

Read More
applicationHost.config Error: Cannot write configuration file due to insufficient permissions with IIS shared configuration

I use the Microsoft.Web.Administration.ServerManager class to manage a web site in a windows service. I use impersonation in my code, with an admin user, the user has the right to modify my applicationHost.config but I always …

Read More