Vulnerability Development mailing list archives

Re: How do web servers handle dropped connections?


From: Philip Rowlands <phr () DOC IC AC UK>
Date: Mon, 28 Aug 2000 15:19:10 +0100

Walter Hop wrote:

looking at the stars last night I was wondering: if I request a scripted
page /blah.pl from a webserver, the server starts the perl interpreter and
runs the script. What happens when the browser breaks the connection
with the web server before the script has finished? Is the script allowed
to execute fully and is the output being discarded afterwards, or is the
process killed immediately? In other words, can server side scripts be
aborted prematurely in this way - and for example corrupt open files or
leave inconsistencies in a database?

http://hoohoo.ncsa.uiuc.edu/cgi/interface.html
It's not mentioned in the CGI spec (URL above), so one could say that
the behavior is undefined, and left up to the server implementor. There
is a draft RFC forthcoming at <http://web.golux.com/coar/cgi/>, but I
can't find any mention in there either.

In practice, I believe webservers will allow a spawned CGI process to
continue to completion. The rationale (although I can't remember where I
read this) is that Perl scripts, etc. might have files, sockets,
database connections open and should expect to be able to complete
whatever operation they are performing.

Consider the converse; you'd have to write ugly signal handling code
into every CGI, to take account of a closed connection at any moment.
You'd have to implement some sort of transaction rollback if you were in
the middle of rewriting a text file etc... not pleasant.


Cheers,

Phil


Current thread: