[ https://issues.jboss.org/browse/WFLY-3797?page=com.atlassian.jira.plugin.... ] Lyle Wang commented on WFLY-3797: --------------------------------- Hi, Stuart: According to the weblogic doc: http://docs.oracle.com/cd/E17904_01/web.1111/e13701/web_server.htm#CNFGD216 There are 3 options can be used to prevent DOS attack: PostTimeoutSecs -- Amount of time that WebLogic Server waits between receiving chunks of data in an HTTP POST. MaxPostTimeSecs -- Maximum time that WebLogic Server spends receiving post data. MaxPostSize -- Maximum number of bytes of data received in a POST from a single request. I think by setting "PostTimeoutSecs" and "MaxPostTimeSecs" properly, it can filter out those requests in your example. What we want is something similar here, it doesn't necessarily need to be one single option, can be multiple that work together (or handle different scenarios). You mentioned "This desired effect can be achieved by setting the read-timeout option on the listener." Are we looking at "Http Connector" section in this doc ? https://docs.jboss.org/author/display/WFLY8/Undertow+%28web%29+subsystem+... Couldn't find anything related to "read-timeout" here, could you give some more info. on this ? Seems "REQUEST_PARSE_TIMEOUT" in UndertowOptions class ? https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io... How can users setup this ? Many Thanks -- This message was sent by Atlassian JIRA (v6.3.8#6338)