Hacker News new | ask | show | jobs
by chime 5157 days ago
> If the user closes the browser tab and no other pages from the same site are opened, the browser may send an explicit request to end the connection, so it does not keep tying the server.

Does this mean keeping a background tab open uses a remote server's resources indefinitely? How can I as the server dev prevent unintentional DDOS?
3 comments
mtigas 5156 days ago
Haven't looked at the SPDY spec[1] too closely, but I think each side of the SPDY (or underlying TCP) connection would be able to idle-disconnect after a timeout or during a high-load situation. (i.e. to prevent idle connections from consuming ports/file descriptors)

So in the case you quoted, the server would also be able to explicitly tell the browser to start a new connection later. (It's not just a browser-to-server signal.)

Generally, most HTTP 1.1 (keepalive-aware) servers have a default timeout for those "persistent" connections[2][3] so this isn't actually a new problem specific to SPDY.

(Aside: simply consuming leaving open an idle TCP connection for later re-use doesn't necessarily imply that idle users will "DDOS" a server. Depending on the server software and OS, the cost-per-socket is low enough that many idle connections isn't actually a problem until you get to port and file descriptor limits — which, again, is already well-dealt with in plenty of other HTTP/TCP applications by using timeouts at all.)

[1]: http://www.chromium.org/spdy/spdy-protocol [2]: http://wiki.nginx.org/HttpCoreModule#keepalive_timeout [3]: https://httpd.apache.org/docs/2.2/mod/core.html#keepalivetim...

link
epenn 5157 days ago
I don't currently have any SPDY experience so if there is a "best practice" for this I'm unaware of it. With that said, I would take a two pronged approach. On the server side you could set a timeout on that user's session to reclaim resources after a period of time that you deem reasonable, regardless of whether you've received an explicit "I'm done" from the user's browser. I would hope server's implementing SPDY would also allow a way to explicitly end a connection as well. If so, I would close the connection at the time that user's session expires.
link
mauriciob 5157 days ago
Maybe close the connection when it hasn't been used for a while?
link