From e26904a9fa671c05297e557a111df85cda8fd91a Mon Sep 17 00:00:00 2001 From: sneak Date: Sat, 14 Nov 2026 16:39:48 +0000 Subject: [PATCH] README: what rproxy gives an app without waf (closes #386) Adds a paragraph to "What it does" listing what rproxy enforces with default settings whether or not waf answers: malformed requests, methods, header size, request and response times, body sizes, idle connections. After the list, it says which header limits are waf's. Removes the "Slow and oversized requests" bullet, which the new list states with figures. Model: opus-5-5 --- README.md | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 49e10c6..9d0df30 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,26 @@ shipped in one image, with two commands that do this together: The site keeps answering while `waf` is down, slow or restarting: without an answer in time, `rproxy` passes the request to the app. -It protects against: +`rproxy` also protects the app on its own, whether or not `waf` answers. With +the default settings, `rproxy`: + +- answers `400` to a malformed request, such as a broken header line or a + missing `Host`; +- answers `405` to a method it does not pass on, such as `TRACE`; +- answers `431` to a request line and headers over 32 KiB together; +- gives the visitor 60 seconds to send the request line and headers, and then 60 + seconds more for the whole request to reach the app; +- answers `413` to a request body over 100 MiB; +- gives the app's answer 30 minutes to reach the visitor, counted from the end + of the request; +- answers `502` in place of an app's answer whose body is over 1 GiB, or cuts it + off if it has started; +- closes a kept-open connection after 120 seconds idle. + +`rproxy` does not limit the number of headers. `waf` limits the number of +headers and cookies, and the length of the request line and of each header line. + +Together, `rproxy` and `waf` protect against: - Scrapers that fetch every page of a site, all day. Each client gets a limit on requests and on body bytes per minute, per hour and per day. The defaults @@ -44,8 +63,6 @@ It protects against: limit, so that they are banned sooner; - refuse or limit clients on a blocklist, a DNS blocklist, or with a high AbuseIPDB score. -- Slow and oversized requests. Every request and every answer has a time limit - and a size limit. For the operator, it: