From 07f8a241d4bb380d83af65eaee0967b0b889270d Mon Sep 17 00:00:00 2001 From: sneak Date: Sat, 14 Nov 2026 16:39:48 +0000 Subject: [PATCH] README: what rproxy gives an app without waf (closes #386) Adds a paragraph to "What it does" listing what rproxy enforces with default settings whether or not waf answers: malformed requests, methods, header size, request and response times, body sizes, idle connections. It says header count and line length limits are waf's. Model: opus-5-5 --- README.md | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 49e10c6..59aa6b2 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,25 @@ shipped in one image, with two commands that do this together: The site keeps answering while `waf` is down, slow or restarting: without an answer in time, `rproxy` passes the request to the app. -It protects against: +`rproxy` also protects the app on its own, whether or not `waf` answers. It +limits the total size of a request's headers, but not their number: the limits +on the number of headers and cookies, and on each header line's length, are +`waf`'s. With the default settings, `rproxy`: + +- answers `400` to a malformed request, such as a broken header line or a + missing `Host`; +- answers `405` to a method it does not pass on, such as `TRACE`; +- answers `431` to a request line and headers over 32 KiB together; +- gives the visitor 60 seconds to send the request line and headers, and then 60 + seconds more for the whole request to reach the app; +- answers `413` to a request body over 100 MiB; +- gives the app's answer 30 minutes to reach the visitor, counted from the end + of the request; +- answers `502` in place of an app's answer whose body is over 1 GiB, or cuts it + off if it has started; +- closes a kept-open connection after 120 seconds idle. + +Together, `rproxy` and `waf` protect against: - Scrapers that fetch every page of a site, all day. Each client gets a limit on requests and on body bytes per minute, per hour and per day. The defaults