Re: [whatwg/fetch] keepalive: Do we need to restrict the number of requests at a time? (#662)

On Thu, Jan 25, 2018 at 10:10 AM Ilya Grigorik <notifications@github.com>
wrote:

> @sleevi <https://github.com/sleevi> thanks, I think we're on the same
> page with respect to motivation + tension.
>
> @igrigorik <https://github.com/igrigorik> We (Chrome) already have 30-sec
> timeout. It's implemented in multiple places for some reasons, but see
> content::KeepAliveHandleFactory for example. We also have a restriction on
> the number of requests in a way in
> content::ResourceDispatcherHostImpl::HasSufficientResourcesForRequest.
>
> @sleevi <https://github.com/sleevi> given the above, what's the
> implementation delta (if any) between what you're asking for and what's
> implemented in Chrome. Or, is the remaining AI here on spec side to
> document these mechanisms?
>

Fairly large, based on the limited data shared so far. Those limits do not
address the concerns raised. We are working to better understand how this
feature was implemented in Chrome, given the apparent lack of mitigations
for both starvation and DoS.

—
> You are receiving this because you were mentioned.
>
>
> Reply to this email directly, view it on GitHub
> <https://github.com/whatwg/fetch/issues/662#issuecomment-360494140>, or mute
> the thread
> <https://github.com/notifications/unsubscribe-auth/ABayJ2sicFah3D9rl2tIBeGFJVGmjUkfks5tOJkZgaJpZM4ReaZf>
> .
>


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/662#issuecomment-360497676