At least one web-server, nginx
, has the ability to "close the connection without sending any headers", by configuring it to return a (nonstandard) 444 to various malformed HTTP requests.
Is there any actual security value in this, or is it just security theater? How are attackers likely to respond to getting no response from an IP address? If there is any value, what's the cost-benefit ratio? Is it worth the effort to configure nginx
to do this?
Update - after thinking about it, there's really two situations where I might want to close the connection. Not just bad HTTP requests, but also well-formed requests for non-existent pages.
For instance, a get /bank-files/index.htm
request. There's no such page on my website. However, currently I'm passing all requests through to a Django process, and it obviously returns a 404 on any not-found pages. Given that my site will have a small number of sub-pages known in advance ("/", "/users", "/orders", etc) - I could configure nginx
to pass through only those pages, and return 444 (close connection) on anything else. Assuming it's worth it. :)
So is there any value in closing the connection to all the requests that are valid HTTP, but for non-existent pages?