Author Topic: TFPHTTPServer DDoS protection  (Read 392 times)

LemonParty

  • Hero Member
  • *****
  • Posts: 619
TFPHTTPServer DDoS protection
« on: August 05, 2026, 02:23:43 pm »
Is it possible to protect given server from DDoS? Maybe create a limit of connections from 1 IP?
Lazarus v. 4.99. FPC v. 3.3.1. Windows 11

Thaddy

  • Hero Member
  • *****
  • Posts: 19626
  • Glad to be alive.
Re: TFPHTTPServer DDoS protection
« Reply #1 on: August 05, 2026, 04:57:38 pm »
No. A single server can not be DDos protected.
Any "programmer" that knows only one programming language is not a programmer

LemonParty

  • Hero Member
  • *****
  • Posts: 619
Re: TFPHTTPServer DDoS protection
« Reply #2 on: August 05, 2026, 06:39:16 pm »
I asked Gemini about DDoS protection and one of variants was:
Quote
Configure your web server (e.g., Nginx, Apache) to throttle abusive clients and drop slow HTTP requests (Slowloris attacks).
Can this type of protection be implemented in TFPHTTPServer?
Lazarus v. 4.99. FPC v. 3.3.1. Windows 11

Warfley

  • Hero Member
  • *****
  • Posts: 2084
Re: TFPHTTPServer DDoS protection
« Reply #3 on: August 10, 2026, 07:58:41 pm »
Don't use a TFPHTTPServer as you main interface anyway. If you put your service on the internet, there will be thousands of bots every day trying to find common vulnerabilities to infect systems, e.g. to deploy malware, FCL-Web is not a security product, it is not hardened, there is no security evaluation of it, etc.
Also it has very limited features e.g. no load balancing and is not really optimized.
Bonus points: You don't need to handle TLS and other annoying things like file caching and resource serving in your server.

Instead you should use one of the major webservers like Apache or NGINX. You can either deploy your pascal webserver as a local server and use Apache or NGINX as a reverse proxy, this can easily be combined with docker for easy deployment, or you use CGI or FastCGI instead.
I'd recommend to use CGI, it's supported by fcl web and you can use the same web modules for HTTP Server and CGI, so you can test locally with a standalone server and deploy as CGI. It's also very simple to deploy as it's just a single binary. Also because every request gets it's own process it is easier to protect against side channel attacks e.g. caused by buffer overflows in the same address space

LemonParty

  • Hero Member
  • *****
  • Posts: 619
Re: TFPHTTPServer DDoS protection
« Reply #4 on: August 11, 2026, 12:54:23 pm »
Warfley, I should refuse from TFPHTTPServer at all when I want use Apache or NGINX?
I asked Gemini about CGI and here what it output (screenshot). I must say a new process per request is really wasteful.
Is there a tutorial for Free Pascal for things you described?
Lazarus v. 4.99. FPC v. 3.3.1. Windows 11

 

TinyPortal © 2005-2018