What is the default limit for concurrent HTTP/2 streams in NGINX?

Question

The default configuration for NGINX, a widely adopted proxy server, includes inherent protections against certain denial-of-service attack vectors, including those leveraging the HTTP/2 protocol. Specifically, the `http2_max_concurrent_streams` setting in NGINX is, by default, configured to limit the number of concurrent streams to **128**. This setting plays a crucial role in mitigating attacks like the HTTP/2 Rapid Reset, which exploits the protocol's stream management capabilities. By enforcing a cap on concurrent streams, NGINX can prevent a single connection from being overwhelmed by a flood of rapidly opened and reset streams, thereby helping to maintain server availability.

Accepted Answer

Beyond the `http2_max_concurrent_streams` directive, NGINX also employs other default configurations that contribute to its resilience. The `keepalive_requests` setting, for instance, is set to a default of 1000 requests. This parameter limits the total number of requests that can be processed over a single keep-alive connection before it is terminated. Together, these default settings act as a fundamental layer of defense. Attackers attempting to exploit vulnerabilities like CVE-2023-44487 would need to establish a significantly larger number of connections or incur more overhead to sustain their attack, making their malicious activities more detectable and easier to block at the network level.

Reading history

Hide →

This history is cleared when the page is closed.

What is the default limit for concurrent HTTP/2 streams in NGINX?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

4

0

0

Share with friends