Weblog

Version 9.11 of the Hiawatha webserver has been released. This release brings the ChallengeClient option, which gives Hiawatha the ability to reduce the effects of a DDoS attack. This is done by checking if the client has a certain cookie set. If this is not the case for the first request within a connection, Hiawatha sends a 307 and this cookie (via a Set-Cookie HTTP header or a Javascript) back to the client. If the second request within a connection doesn't has this cookie, the client is banned. The idea is that normal browsers understand the 307 and the HTTP Set-Cookie header or the Javascript, but HTTP bots don't.

Please note that this although this option works from a technical point of view, it should be used with great care. Proper testing is strongly advised. Also note that this option should only be used when options like ConnectionsPerIP, ReconnectDelay and BanOnFlooding are insufficient.

Many thanks to Andrey Vasilev and Chris Wadge for all the testing and feedback.