Limiting the size of a HTTP post request on JBoss

I am using Jboss 4.2.3 as an appserver. Is there a way to limit the size of the HTTP Post request accepted by JBoss? I want to limit the size to avoid DOS attacks.

I already sat maxHttpHeaderSize and maxPostSize in the server.xml, but neither of them seem to 开发者_高级运维make any difference.

maxPostSize defines how big a POST can get before Tomcat will "automatically" parse it, whatever that means.

If you're doing this for security reasons, you need to think twice about how you do it. A DOS attack isn't going to conveniently announce its size as an HTTP request header, it's just going to send data until your server falls over.

You could check the Content-Length header of the request, and reject it immediately if it's not present, or too big, but you run the risk of rejecting genuine clients that don't supply the header, which many won't.

Otherwise, you're just going to have to read the request data until it crosses a threshold, and then reject it.

Either way, the container can't help you much.

For Jboss you should configure in configuration file (eg: standalone-full.xml) like this: with max-post-size="26214400" means 25MB

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
        <buffer-cache name="default"/>
        <server name="default-server">
            <http-listener name="default" max-post-size="26214400" socket-binding="http" redirect-socket="https"/>
            <host name="default-host" alias="localhost">
                <location name="/" handler="welcome-content"/>
                <filter-ref name="server-header"/>
                <filter-ref name="x-powered-by-header"/>
            </host>
        </server>
        <servlet-container name="default">
            <jsp-config/>
            <websockets/>
        </servlet-container>
        <handlers>
            <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
        </handlers>
        <filters>
            <response-header name="server-header" header-name="Server" header-value="JBoss-EAP/7"/>
            <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
        </filters>
    </subsystem>

Lets say we have the a default standalone configuration settings of undertow module which sets max-post-size to 10mb. Documentation on RedHat.

<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-virtual-host="default-host" statistics-enabled="true">
            <buffer-cache name="default"/>
            <server name="default-server" default-host="default-host">
                <http-listener name="http" socket-binding="http" max-parameters="20000" allow-unescaped-characters-in-url="true" proxy-address-forwarding="true" enable-http2="true"/>
                <host name="default-host" alias="localhost">
                    <filter-ref name="samesite-cookie"/>
                    <filter-ref name="hsts-header"/>
                    <filter-ref name="x-frame-options"/>
                    <filter-ref name="x-xss-protection"/>
                    <filter-ref name="x-content-type-options"/>
                    <filter-ref name="gzipfilter"/>
                    <http-invoker security-realm="ApplicationRealm"/>
                </host>
            </server>
...

To change the max-post-size variable to whatever variable is desire we can connect to JBOSS CLI and execute the following command to update the configuration. If you do not know how to connect to JBOSS CLI, here is the official documentation.

/subsystem="undertow"/server="default-server"/http-listener="http":write-attribute(name=max-post-size,value=11534336)

Once the command is executed your standalone configuration should look like that:

<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-virtual-host="default-host" statistics-enabled="true">
            <buffer-cache name="default"/>
            <server name="default-server" default-host="default-host">
                <http-listener name="http" socket-binding="http" max-post-size="11534336" max-parameters="20000" allow-unescaped-characters-in-url="true" proxy-address-forwarding="true" enable-http2="true"/>
                <host name="default-host" alias="localhost">
                    <filter-ref name="samesite-cookie"/>
                    <filter-ref name="hsts-header"/>
                    <filter-ref name="x-frame-options"/>
                    <filter-ref name="x-xss-protection"/>
                    <filter-ref name="x-content-type-options"/>
                    <filter-ref name="gzipfilter"/>
                    <http-invoker security-realm="ApplicationRealm"/>
                </host>
            </server>
...

This means that now the max-post-size is set to 11mb.