Slow Header Attack Detection (8.0.0)

FortiWeb 8.0.0 enhances its Threshold Based Detection module with support for detecting slow header attacks—a type of low-rate denial-of-service (LDoS) technique that delays transmission of HTTP headers to tie up server resources. These attacks exploit the time-sensitive nature of HTTP parsing, keeping connections open by sending header fields at deliberately slow intervals.

This enhancement complements existing protection against slow body (write) attacks. FortiWeb now tracks the timing of incoming header packets and closes connections when they exceed predefined behavioral thresholds, even if the full request has not yet been received.

Detection Logic

When slow attack detection is enabled in a server policy, FortiWeb uses the existing configuration parameters for slow body attacks to evaluate slow header activity:

• Packet Interval Timeout defines the maximum allowed delay between header packets.

• Occurrence Threshold specifies how many delayed packets are tolerated before action is taken.

If a request’s headers are received too slowly and the threshold is exceeded, FortiWeb immediately drops the connection. No block page or CAPTCHA is presented, since the full HTTP request is never completed.

This detection logic is fully integrated with the Threshold-Based Detection system and does not require separate configuration for header versus body inspection.

Behavioral Notes and Limitations

• Tracking fallback

  This enhancement does not support Tracking by Client ID, which was introduced in FortiWeb 8.0.0. If the system is configured to use Client ID tracking, FortiWeb will automatically fall back to tracking by client IP when a slow header attack is detected. This fallback is necessary because the required Client ID and HTTP-level metadata are not available at the TCP layer, where slow header inspection occurs. Consequently, actions such as Client ID Period Block will default to IP-based Period Block in these cases.

• Incomplete requests

  Since slow header attacks typically involve incomplete or malformed HTTP requests, FortiWeb cannot apply Real Browser Enforcement or CAPTCHA challenges. Instead, it terminates the TCP session directly if an action such as Deny (no log), Alert and Deny, or Period Block is configured.

• Shared thresholds

  Slow header detection shares the same configuration and thresholds as slow body detection. Users cannot configure different timeout or interval thresholds for each. Enhancements for separate parameterization may be considered in future releases.

• Unsupported in content routing mode

  This enhancement does not currently operate when the server policy is configured in content routing mode.