Preventing POST Denial of Service Attacks

You can set up the WebLogic Server so it prevents POST denial-of-service requests, which are designed to overwhelm a web server by sending enormous amounts of data in an HTTP post request with the intention of causing disruption by overloading the server. You can set the following attributes in the Administration Console for both normal and virtual servers to prevent these types of attacks.

The PostTimeoutSecs attribute controls the time the server pauses in between the receiving of chunks of HTTP POST data. The MaxPostTimeSecs attribute sets the maximum time a server may continue to receive POST data. Finally, the MaxPostSize attribute limits the number of bytes in a single POST method HTTP request. This can be configured via the Administration Console by navigating to Server | Protocols | HTTP. Note that Oracle recommends that you leave the default settings on for all three attributes.