The GET Request That Never Ends: A Denial-of-Service Hiding in Plain Sight
Picture this: you’ve built an API. Every sensitive route sits behind auth middleware. Then someone sends a single GET request — no login, no token, nothing malicious-looking in any log you'd normally check — and it just.
Picture this: you’ve built an API. Every sensitive route sits behind auth middleware. Then someone sends a single GET request — no login, no token, nothing malicious-looking in any log you'd normally check — and it just... sits there. Not crashing. Not erroring. Just holding a connection open, silently, for as long as your infrastructure lets it.
Do that a few dozen times in parallel, and depending on how your stack is built, you can go from “fully operational” to “refusing every legitimate request” — without ever touching your authentication, without exploiting a single line of business logic, and without leaving behind the kind of error that makes anyone go looking.
This is a Denial of Service (DoS) — one of the oldest, most well-understood attack categories in web security, hiding inside a request that looks, on its face, completely harmless. This post is about why that’s possible, why it’s more possible than most teams assume, and — the part that should actually worry you — why the exact defenses you already believe are protecting you might not be wired up the way you think.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.