HTTP Slowloris & Slow POST DDoS Defense on Nginx

Protect Nginx web servers from Slowloris and Slow HTTP POST attacks that tie up worker connections using ultra-slow byte transmissions.

1. Attack Signature & Impact Analysis

High (Service Exhaustion)

Slowloris opens hundreds of connections and sends periodic incomplete HTTP headers (e.g. X-a: b\r\n) every few seconds to keep connection slots occupied, starving real users.

2. Production Hardening Configuration (`/etc/nginx/conf.d/slowloris-mitigation.conf`)

Deploy this validated configuration to your production server or reverse proxy:

# Mitigate Slowloris by reducing client timeouts and buffer limits
http {
    # Max time client can take to transmit headers (default is 60s -> reduce to 10s)
    client_header_timeout 10s;

    # Max time client can take to transmit request body between two read operations
    client_body_timeout 10s;

    # Max idle time for keepalive connections
    keepalive_timeout 15s;

    # Max time for transmitting response back to client
    send_timeout 10s;

    # Buffer sizes for request headers
    client_header_buffer_size 1k;
    large_client_header_buffers 4 8k;
}

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Test with slowhttptest (Simulate 500 slow connections for 15s)
slowhttptest -c 500 -H -g -o slowloris_test -i 10 -r 200 -t GET -u https://yourdomain.com -l 15
# Check if Nginx active connections drop immediately without 504 gateway timeout

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: Setting client_header_timeout lower than 5s may drop mobile clients on high-latency 3G/poor cellular networks. 10s is the sweet spot for production.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: