Web sites must limit the number of simultaneous requests.

Part of WG110

SV-32323r6_rule Web sites must limit the number of simultaneous requests.

Vulnerability discussion

Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web-site, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).

Check content

1. Open an administrator command prompt. 2. CD \Windows\system32\inetsrv 3. Enter the command: appcmd list config /section:system.applicationHost/sites > out.txt (opens output in Notepad). 4. Review the results and verify each website has a value greater than zero listed for maxconnections parameter. If not, this is a finding. If nothing is listed, this is also a finding.

Fix text

For the site under review, determine the maximum number of connections needed. 1. Open an administrator command prompt. 2. CD \Windows\system32\inetserv 3. Enter the command: appcmd set config -section:system.applicationHost/sites "/[name='Default Web Site'].limits.maxConnections:X" /commit:apphost Note: Replace SITENAME with the site under review and X with the maximum number of connections allowable. 4. Enter the command to verify changes: appcmd list config –section:system.applicationHost/sites>out.txt (opens output in Notepad).

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.