How do you protect a Node.js server from Slowloris attacks and implement request rate limiting (Rate Limiting)?

Short answer

Protect against Slowloris by setting strict header timeouts (headersTimeout), and apply Rate Limiting with a Token Bucket algorithm and a shared Redis store.

Explanation

A Slowloris attack sends HTTP headers very slowly to keep server connections open until the available sockets are exhausted. In Node.js, server.headersTimeout and server.requestTimeout set the maximum time allowed to receive headers. Rate Limiting restricts the number of requests allowed per IP address or user within a time window, using a distributed store.

Code example

server.headersTimeout = 5000;
server.requestTimeout = 10000;

Common mistakes

• Storing Rate Limiting counters in local application memory when running multiple instances (Clustered), which makes the limits ineffective.

Follow-up questions

• How do you safely handle multipart/form-data requests and file uploads in Node.js servers?

Sources

• Node.js docs — server.headersTimeout