dotnet / dotnet/aspnetcore

Eliminate Microsoft.AspNetCore.Server.Kestrel.Http2.MaxConnectionFlowControlQueueSize

Open
#51,309 1 comment 0 reactions 0 assignees View on GitHub
area-networking HTTP2
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

We introduced an AppContext property in #51304 because it was less risky that improving the clean-up code to prevent [_waitingForMoreConnectionWindow](https://github.com/dotnet/aspnetcore/blob/9719821d5bb09c7cf75f82a223e8b210da65aaca/src/Servers/Kestrel/Core/src/Internal/Http2/Http2FrameWriter.cs#L74) from overflowing in the first place. It should probably be pruned as streams are closed.

### Expected Behavior

_No response_

### Steps To Reproduce

The queue grows very quickly during Rapid Reset attacks when `Microsoft.AspNetCore.Server.Kestrel.Http2.MaxConnectionFlowControlQueueSize` is disabled (e.g. by setting it to 0).

### Exceptions (if any)

_No response_

### .NET Version

_No response_

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.