I develop backends with flask and I'm currently reading about attacks such as the Billion laughs attack. Although I'm aware of other ways to defend against them, my motivation for this question is defense in depth (take several different defenses in different components - if one gets bypassed, hopefully, others are effective).
One user should not be able to cause a DOS for other users. If I run Flask via gunicorn, I think it generates one thread per request. Is it possible to set hard CPU usage/memory usage limits to those threads?
What I found
From what I found, I guess that it might either be impossible or that I'm looking at the wrong level:
- gunicorn security: Seems only about restricting the headers/payload of the request
- Flask security: Seems only to be about XSS, CSRF, CSP, and various headers
- Flask-Limiter: Rate limiting for flask
I thought that the main process needs to take care of administrating it's threads, but maybe the OS can/has to do that as well?