Skip to content

Comment on Cookie Bomb or Let's Break the Internet

Comments

Possible detection method (server side)? If the request is too long due to cookie length, then look at the last URL the client IP hit. That should be the URL creating the long cookies. Remove the offending URL / resource.

That won't work, and could be easily abused by crafting your own requests to blame any arbitrary URL of your choosing.

Plus, servers drop huge requests because they are most likely malformed or DOS attempts. Attempting to do extra work (like tracking down previous visits by the client) will only make matters worse for the server.

Hmmm. Yes,I see the potential for abuse. Why do you say it would not work though?

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.