upstream hijacking, streamed uploads about falcon

[ioquatix]

This behaviour is complaint with Rack 2 and Rack 3.

Puma buffers the input body to prevent slow client attacks because it has a limited worker pool and it's fairly easy to tie up all workers with slow requests.

Falcon can create an unbounded (but memory/cpu limited) number of fibers so it's less susceptible to these kinds of attacks but it's still a possibility. We will introduce more advanced mechanisms to protect against this kind of attack in the future too.

In the case of Falcon, env['rack.input'] is streamed directly from the client, so you can read from that and do whatever you want with it. It behaves similar to an IO object.

[pschrammel]

great...I'll try to contribute an example ASAP for the future readers.