40. DoS and DDoS – Availability Attacks

40.5 Application-Layer DoS – Slow and Heavy Requests

By Ravindra Bagale · Last updated: 27 September 2026

Application-layer DoS does not always need Tbps. Ideas defenders must know:

• Many requests to expensive URLs (search, report export, login without cache)
• Slowloris-class concepts: hold many connections open slowly so worker slots exhaust (Apache/nginx worker limits matter)
• Large slow POST bodies / incomplete headers (timeouts help)

Blue fixes that actually help SMEs:

• limit_req / limit_conn in nginx; Apache mod_evasive / reqtimeout modules (distro docs)
• Short timeouts; sensible worker_connections / MaxRequestWorkers
• WAF / bot management at CDN
• Cache static + safe GETs at edge

# nginx snippet for YOUR lab origin – rate limit zone (example values; tune!)
limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
server {
    listen 80;
    server_name orders.lab;
    location / {
        limit_req zone=one burst=10 nodelay;
        proxy_read_timeout 10s;
        # root /var/www/orders;  ...
    }
}

# Amazon Linux style – after editing nginx config on YOUR VM
sudo nginx -t
sudo service nginx reload