I am using Nginx as a reverse proxy. When sending it an infinite amount of garbage, and the back-end application already responded to the request (for example with some error), Nginx will patiently wait for the client to finish talking before replying.
I'm not sure why Nginx delays the response at all (it's a bidirectional/full duplex connection and it has the response fully buffered), probably some HTTP protocol reason, but what I'm mainly wondering is why the timeout it so high? Why wait 30 seconds for the client to stop blabbering before giving it the response? In what (legitimate) scenario does this happen? I can only think of slowloris or other DoS attacks.
I can imagine the client is still sending headers when the back-end (or Nginx itself) already discovered the IP is not allowed, so you have to let it finish sending headers, but that would be at most a few kilobytes if you have some weirdly large cookie. Even on GPRS, that's about 1-2 seconds. Why set the default to 30 and allow someone to keep a connection open and active for that long, when it knows it's only wasting CPU?