HttPrevayler

[Klaus Wuestefeld]

Hi,

A friend of mine has plans to implement an HTTP proxy that journals
the requests, inserts in them a "timestamp" parameter and forwards
them to a web app.

That way, any web app can become persistent 100% transparently.

Ideas? Problems? Questions? Suggestions?

Has anyone done anything similar?

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Klaus Wuestefeld]

I forgot to say it is a reverse proxy. It will sit on the server side,
not the client side.



On Tue, Jun 9, 2009 at 6:03 PM, Klaus
Wuestefeld<klauswuestefeld@...> wrote:

> Hi,
>
> A friend of mine has plans to implement an HTTP proxy that journals
> the requests, inserts in them a "timestamp" parameter and forwards
> them to a web app.
>
> That way, any web app can become persistent 100% transparently.
>
> Ideas? Problems? Questions? Suggestions?
>
> Has anyone done anything similar?
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Sergey Didenko]

What is the advantage of this approach over the usual "journalling the
database transactions"?

On Wed, Jun 10, 2009 at 12:11 AM, Klaus
Wuestefeld<klauswuestefeld@...> wrote:

> I forgot to say it is a reverse proxy. It will sit on the server side,
> not the client side.
>
>
>
> On Tue, Jun 9, 2009 at 6:03 PM, Klaus
> Wuestefeld<klauswuestefeld@...> wrote:
>> Hi,
>>
>> A friend of mine has plans to implement an HTTP proxy that journals
>> the requests, inserts in them a "timestamp" parameter and forwards
>> them to a web app.
>>
>> That way, any web app can become persistent 100% transparently.
>>
>> Ideas? Problems? Questions? Suggestions?
>>
>> Has anyone done anything similar?
>>
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Klaus Wuestefeld]

1) It will work with any web system, not only Java.

But mainly:

2) We do not have to create and use the Transaction classes.

It is transparent not only to the business code but also to the
communication code.

See you, Klaus.


On Wed, Jun 10, 2009 at 12:19 PM, Sergey
Didenko<sergey.didenko@...> wrote:

> What is the advantage of this approach over the usual "journalling the
> database transactions"?
>
> On Wed, Jun 10, 2009 at 12:11 AM, Klaus
> Wuestefeld<klauswuestefeld@...> wrote:
>> I forgot to say it is a reverse proxy. It will sit on the server side,
>> not the client side.
>>
>>
>>
>> On Tue, Jun 9, 2009 at 6:03 PM, Klaus
>> Wuestefeld<klauswuestefeld@...> wrote:
>>> Hi,
>>>
>>> A friend of mine has plans to implement an HTTP proxy that journals
>>> the requests, inserts in them a "timestamp" parameter and forwards
>>> them to a web app.
>>>
>>> That way, any web app can become persistent 100% transparently.
>>>
>>> Ideas? Problems? Questions? Suggestions?
>>>
>>> Has anyone done anything similar?
>>>
>>
>> ------------------------------------------------------------------------------
>> Crystal Reports - New Free Runtime and 30 Day Trial
>> Check out the new simplified licensing option that enables unlimited
>> royalty-free distribution of the report engine for externally facing
>> server and web deployment.
>> http://p.sf.net/sfu/businessobjects
>> _______________________________________________
>> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
>> _______________________________________________
>> "Databases in Memoriam" -- http://www.prevayler.org
>>
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Edward Kimber]

If I understood this correctly, it won't be possible to take snapshots
and eventually that would mean a long start-up time.

Also, although it is transparent the app must still be a deterministic system.

Ed

2009/6/9 Klaus Wuestefeld <klauswuestefeld@...>:

> Hi,
>
> A friend of mine has plans to implement an HTTP proxy that journals
> the requests, inserts in them a "timestamp" parameter and forwards
> them to a web app.
>
> That way, any web app can become persistent 100% transparently.
>
> Ideas? Problems? Questions? Suggestions?
>
> Has anyone done anything similar?
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Klaus Wuestefeld]

> If I understood this correctly, it won't be possible to take snapshots
> and eventually that would mean a long start-up time.

You are right.

We are planning of defining an http request that HttPrevayler, the
journaling reverse-proxy, on startup, can send to the web app and ask
it: "Web app, what is the last transaction id you have?"

The web app would only be in charge of doing the snapshot then, which
is a much simpler task (trivial on Java and .NET) than creating the
transaction classes and using them.

Ralph Johnson, co-author of "Design-Patterns", has reported on this
list about a system of his that is in use for years only with the
transaction log and no snapshots. He had a relatively low transaction
rate, of course.


> Also, although it is transparent the app must still be a deterministic system.

Sure.

Klaus.

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Sergey Didenko]

So the web app can be written to be just in memory then.
Or just to make occasional snapshots and load the last one on restart.

Interesting idea. Though I can't understand right now how practical it is.

What about failed requests? Does proxy just journal a request or does
it wait to see if the web app fails?

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Klaus Wuestefeld]

Thanks. This is helping a lot. :)

Three kinds os failures:

1) Garden-variety bugs, broken links, etc. In these cases the web app
will behave deterministically so we don't have to consider these as
failures for our purposes.

2) Non-deterministic OutOfMemory-style catastrophical failures of the
web app. Every http request must be sent to the web app with a
sequence number as a parameter. The web app can refuse (reply with a
specific error) saying: "Sorry, you sent me request 45, I was
expecting request 42". HttPrevayler then starts re-sending requests
since 42. So, if the web app crashes (OOM or StackOverflow, for
example) and is rebooted, we are ok.

3) Network failures between proxy and web app. Solved the same as 2)
above, with the request sequence number.

Our only problem is failures which are both non-catastrophic AND
non-deterministic.

Klaus.


On Wed, Jun 10, 2009 at 3:00 PM, Sergey Didenko<sergey.didenko@...> wrote:

> So the web app can be written to be just in memory then.
> Or just to make occasional snapshots and load the last one on restart.
>
> Interesting idea. Though I can't understand right now how practical it is.
>
> What about failed requests? Does proxy just journal a request or does
> it wait to see if the web app fails?
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Sergey Didenko]

If this proxy relies on the current Prevayler and waits for a request
to finish then one long request can suspend all the others. It will be
a bottleneck because of the single lock inside Prevayler.

If it does not wait for a request to finish then how those failed
requests are going to be handled?

On Wed, Jun 10, 2009 at 10:07 PM, Klaus
Wuestefeld<klauswuestefeld@...> wrote:

> Thanks. This is helping a lot. :)
>
> Three kinds os failures:
>
> 1) Garden-variety bugs, broken links, etc. In these cases the web app
> will behave deterministically so we don't have to consider these as
> failures for our purposes.
>
> 2) Non-deterministic OutOfMemory-style catastrophical failures of the
> web app. Every http request must be sent to the web app with a
> sequence number as a parameter. The web app can refuse (reply with a
> specific error) saying: "Sorry, you sent me request 45, I was
> expecting request 42". HttPrevayler then starts re-sending requests
> since 42. So, if the web app crashes (OOM or StackOverflow, for
> example) and is rebooted, we are ok.
>
> 3) Network failures between proxy and web app. Solved the same as 2)
> above, with the request sequence number.
>
> Our only problem is failures which are both non-catastrophic AND
> non-deterministic.
>
> Klaus.
>
>
> On Wed, Jun 10, 2009 at 3:00 PM, Sergey Didenko<sergey.didenko@...> wrote:
>> So the web app can be written to be just in memory then.
>> Or just to make occasional snapshots and load the last one on restart.
>>
>> Interesting idea. Though I can't understand right now how practical it is.
>>
>> What about failed requests? Does proxy just journal a request or does
>> it wait to see if the web app fails?
>>
>> ------------------------------------------------------------------------------
>> Crystal Reports - New Free Runtime and 30 Day Trial
>> Check out the new simplified licensing option that enables unlimited
>> royalty-free distribution of the report engine for externally facing
>> server and web deployment.
>> http://p.sf.net/sfu/businessobjects
>> _______________________________________________
>> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
>> _______________________________________________
>> "Databases in Memoriam" -- http://www.prevayler.org
>>
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Klaus Wuestefeld]

The web app must process one transaction request at a time anyway or
else determinism is lost.

So we are supposing there are no long-running transaction requests.

Klaus.




On Wed, Jun 10, 2009 at 6:02 PM, Sergey Didenko<sergey.didenko@...> wrote:

> If this proxy relies on the current Prevayler and waits for a request
> to finish then one long request can suspend all the others. It will be
> a bottleneck because of the single lock inside Prevayler.
>
> If it does not wait for a request to finish then how those failed
> requests are going to be handled?
>
> On Wed, Jun 10, 2009 at 10:07 PM, Klaus
> Wuestefeld<klauswuestefeld@...> wrote:
>> Thanks. This is helping a lot. :)
>>
>> Three kinds os failures:
>>
>> 1) Garden-variety bugs, broken links, etc. In these cases the web app
>> will behave deterministically so we don't have to consider these as
>> failures for our purposes.
>>
>> 2) Non-deterministic OutOfMemory-style catastrophical failures of the
>> web app. Every http request must be sent to the web app with a
>> sequence number as a parameter. The web app can refuse (reply with a
>> specific error) saying: "Sorry, you sent me request 45, I was
>> expecting request 42". HttPrevayler then starts re-sending requests
>> since 42. So, if the web app crashes (OOM or StackOverflow, for
>> example) and is rebooted, we are ok.
>>
>> 3) Network failures between proxy and web app. Solved the same as 2)
>> above, with the request sequence number.
>>
>> Our only problem is failures which are both non-catastrophic AND
>> non-deterministic.
>>
>> Klaus.
>>
>>
>> On Wed, Jun 10, 2009 at 3:00 PM, Sergey Didenko<sergey.didenko@...> wrote:
>>> So the web app can be written to be just in memory then.
>>> Or just to make occasional snapshots and load the last one on restart.
>>>
>>> Interesting idea. Though I can't understand right now how practical it is.
>>>
>>> What about failed requests? Does proxy just journal a request or does
>>> it wait to see if the web app fails?
>>>
>>> ------------------------------------------------------------------------------
>>> Crystal Reports - New Free Runtime and 30 Day Trial
>>> Check out the new simplified licensing option that enables unlimited
>>> royalty-free distribution of the report engine for externally facing
>>> server and web deployment.
>>> http://p.sf.net/sfu/businessobjects
>>> _______________________________________________
>>> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
>>> _______________________________________________
>>> "Databases in Memoriam" -- http://www.prevayler.org
>>>
>>
>> ------------------------------------------------------------------------------
>> Crystal Reports - New Free Runtime and 30 Day Trial
>> Check out the new simplified licensing option that enables unlimited
>> royalty-free distribution of the report engine for externally facing
>> server and web deployment.
>> http://p.sf.net/sfu/businessobjects
>> _______________________________________________
>> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
>> _______________________________________________
>> "Databases in Memoriam" -- http://www.prevayler.org
>>
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Sergey Didenko]

What if a user uploads a big file on a slow connection?

> The web app must process one transaction request at a time anyway or
> else determinism is lost.
>
> So we are supposing there are no long-running transaction requests.
>
> Klaus.

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Justin T. Sampson-2]

On Wed, Jun 10, 2009 at 2:32 PM, Sergey Didenko
<sergey.didenko@...> wrote:

> > The web app must process one transaction request at a time anyway or
> > else determinism is lost.
> >
> > So we are supposing there are no long-running transaction requests.
>
> What if a user uploads a big file on a slow connection?

Well, the proxy can't send a request on to the web app until it's been
journaled, so the proxy will have to wait to receive the entire file
anyway. Other requests can be forwarded to the web app while the file
is still uploading...

*IF* the web app is written correctly so that GET is always read-only,
then you could even optimize things such that multiple GET requests
could be forwarded concurrently, without journaling them.

Cheers,
Justin

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Klaus Wuestefeld]

We do not have that case. I would estimate only 0.72% of websites out
there have that case.

But it would, yes, require a workaround.

One solution could be to make the browser upload the file directly to
some temp staging area on the web server, bypassing the proxy
completely, and then just sending a "File XYZ upload completed"
request to the proxy. That is transparent to the end-user, of course.

Klaus.



On Wed, Jun 10, 2009 at 6:32 PM, Sergey Didenko<sergey.didenko@...> wrote:

> What if a user uploads a big file on a slow connection?
>
>> The web app must process one transaction request at a time anyway or
>> else determinism is lost.
>>
>> So we are supposing there are no long-running transaction requests.
>>
>> Klaus.
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Sergey Didenko]

This proxy can be easily DOSed unless it has a really, really short
timeout for browser requests. The attacker just need to send the first
part of a request and wait. No other requests will be processed at
that moment.

On Thu, Jun 11, 2009 at 12:43 AM, Klaus
Wuestefeld<klauswuestefeld@...> wrote:

> We do not have that case. I would estimate only 0.72% of websites out
> there have that case.
>
> But it would, yes, require a workaround.
>
> One solution could be to make the browser upload the file directly to
> some temp staging area on the web server, bypassing the proxy
> completely, and then just sending a "File XYZ upload completed"
> request to the proxy. That is transparent to the end-user, of course.
>
> Klaus.
>
>
>
> On Wed, Jun 10, 2009 at 6:32 PM, Sergey Didenko<sergey.didenko@...> wrote:
>> What if a user uploads a big file on a slow connection?
>>
>>> The web app must process one transaction request at a time anyway or
>>> else determinism is lost.
>>>
>>> So we are supposing there are no long-running transaction requests.
>>>
>>> Klaus.
>>
>> ------------------------------------------------------------------------------
>> Crystal Reports - New Free Runtime and 30 Day Trial
>> Check out the new simplified licensing option that enables unlimited
>> royalty-free distribution of the report engine for externally facing
>> server and web deployment.
>> http://p.sf.net/sfu/businessobjects
>> _______________________________________________
>> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
>> _______________________________________________
>> "Databases in Memoriam" -- http://www.prevayler.org
>>
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org

[Klaus Wuestefeld]

No. It can receive requests in parallel. It will only forward the
request to the web server once it has received it entirely.

Justin's post mentions this too.

Klaus.


On Fri, Jun 12, 2009 at 3:50 AM, Sergey Didenko<sergey.didenko@...> wrote:

> This proxy can be easily DOSed unless it has a really, really short
> timeout for browser requests. The attacker just need to send the first
> part of a request and wait. No other requests will be processed at
> that moment.
>
> On Thu, Jun 11, 2009 at 12:43 AM, Klaus
> Wuestefeld<klauswuestefeld@...> wrote:
>> We do not have that case. I would estimate only 0.72% of websites out
>> there have that case.
>>
>> But it would, yes, require a workaround.
>>
>> One solution could be to make the browser upload the file directly to
>> some temp staging area on the web server, bypassing the proxy
>> completely, and then just sending a "File XYZ upload completed"
>> request to the proxy. That is transparent to the end-user, of course.
>>
>> Klaus.
>>
>>
>>
>> On Wed, Jun 10, 2009 at 6:32 PM, Sergey Didenko<sergey.didenko@...> wrote:
>>> What if a user uploads a big file on a slow connection?
>>>
>>>> The web app must process one transaction request at a time anyway or
>>>> else determinism is lost.
>>>>
>>>> So we are supposing there are no long-running transaction requests.
>>>>
>>>> Klaus.
>>>
>>> ------------------------------------------------------------------------------
>>> Crystal Reports - New Free Runtime and 30 Day Trial
>>> Check out the new simplified licensing option that enables unlimited
>>> royalty-free distribution of the report engine for externally facing
>>> server and web deployment.
>>> http://p.sf.net/sfu/businessobjects
>>> _______________________________________________
>>> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
>>> _______________________________________________
>>> "Databases in Memoriam" -- http://www.prevayler.org
>>>
>>
>> ------------------------------------------------------------------------------
>> Crystal Reports - New Free Runtime and 30 Day Trial
>> Check out the new simplified licensing option that enables unlimited
>> royalty-free distribution of the report engine for externally facing
>> server and web deployment.
>> http://p.sf.net/sfu/businessobjects
>> _______________________________________________
>> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
>> _______________________________________________
>> "Databases in Memoriam" -- http://www.prevayler.org
>>
>
> ------------------------------------------------------------------------------
> Crystal Reports - New Free Runtime and 30 Day Trial
> Check out the new simplified licensing option that enables unlimited
> royalty-free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
> _______________________________________________
> "Databases in Memoriam" -- http://www.prevayler.org
>

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
To unsubscribe go to the end of this page: http://lists.sourceforge.net/lists/listinfo/prevayler-discussion
_______________________________________________
"Databases in Memoriam" -- http://www.prevayler.org