Ubuntu
haproxy package

  1. Bug #1919468
  2. Comment #3

Comment 3 for bug 1919468

Revision history for this message
Malte Schmidt (maltris) wrote :

Hello Seth,

unfortunately, this is incorrect.

   HTTP/1.1 defines the "close" connection option for the sender to
   signal that the connection will be closed after completion of the
   response.

https://tools.ietf.org/html/rfc2616#section-14.10

But the server with Ubuntus HAProxy 2.0.13 will not proactively do it. Therefore, as described above, it is very easy for a malicious application to fill up the servers memory and connection pool.

With my minimal working example and a HAProxy docker container, you may easily and rather quickly be able to reproduce that. If this is expected behaviour, then I'm sorry for this ticket, which can be closed. (Migrated all my HAProxy based endpoints to a version not having this problem ;) )