Saint Rapid Reset, Who Asked and Instantly Cancelled

Patron of HTTP/2 servers, on-call CDN engineers, and people who change their minds a thousand times a second.

Life

On 10 October 2023 Google, Cloudflare and Amazon jointly revealed an attack abusing a legitimate HTTP/2 feature: open a request and cancel it at once with an RST_STREAM, forever. The server did work for every request, the client never waited for an answer. Relatively small botnets set records never seen before, up to 398 million requests per second against Google.

Prayer

O Saint Rapid Reset, who opens and closes like an indecisive diner, teach our servers to say enough. Amen.

How to celebrate

Celebrated by updating HTTP/2 servers and proxies with limits on cancelled streams, and making a decision on the first try.

He who always cancels keeps everyone else busy.