Subject: WEBDAV and server request time out

From: Jeff Thompson <[email-masked]>
Date: Thu, 15 May 2003 17:59:34 -0600

I've been looking into WEBDAV and trying to understand how we might make 
use of it. I've come up against an implementation issue that I have not 
been able to find much information on. I thought I might be able to get 
some enlightenment here.

The issue concerns the uploading of very large files over slower 
connections (i.e., cable modem).

Our web server has a default request timeout of 90 seconds. I know how 
to increase that. However, I heard some unsubstantiated rumor that 
increasing this very much comprises security. I have not been able to 
figure out the security implications of changing this value. I recognize 
that there are some potential Denial of Service attacks by allowing 
large files. A lengthly request timeout probably has some Denial of 
Service problems.

What considerations might be involved in raising the timeout to handle 
large files?

Is WEBDAV a viable solution for handling large files in these circumstances?

Thanks,

Jeff

---

From: Stefan Eissing <[email-masked]>
Date: Fri, 16 May 2003 09:33:19 +0200

Jeff,

are you sure that the request timeout affects uploading of large files? 
Most
timeout values reflect inactivity on the connection. So the timeout 
would
strike when 90 seconds of inactivity are encountered.

When uploading large files, this timeout should not cut the connection, 
as
packets should continue to come, even from a slow connection, in smaller
intervals than 90 seconds.

Best Regards, Stefan

Am Freitag, 16.05.03, um 01:59 Uhr (Europe/Berlin) schrieb Jeff 
Thompson:

>
> I've been looking into WEBDAV and trying to understand how we might 
> make use of it. I've come up against an implementation issue that I 
> have not been able to find much information on. I thought I might be 
> able to get some enlightenment here.
>
> figure out the security implications of changing this value. I 
> recognize that there are some potential Denial of Service attacks by 
> allowing large files. A lengthly request timeout probably has some 
> Denial of Service problems.
>