tree d5b20ceb8275a543c044fe6f2b7747204c45ed41
parent 2ded731cf8f6972044ad4b4ac6d0c8f910bc9939
author Ruslan Ermilov <ru@nginx.com> 1586296937 +0300
committer Ruslan Ermilov <ru@nginx.com> 1586296937 +0300

The new auth_delay directive for delaying unauthorized requests.

The request processing is delayed by a timer.  Since nginx updates
internal time once at the start of each event loop iteration, this
normally ensures constant time delay, adding a mitigation from
time-based attacks.

A notable exception to this is the case when there are no additional
events before the timer expires.  To ensure constant-time processing
in this case as well, we trigger an additional event loop iteration
by posting a dummy event for the next event loop iteration.