A Node HTTP server ships with a handful of server-side timeouts. What are they, and which attack is each one actually there to stop?
The strong answer names all three server-side timeouts and ties each one to the specific slow-client attack or leak it exists to bound.
There are a few timeouts on the server object. server.timeout is how long a socket can sit idle before Node destroys it. Then there's keepAliveTimeout, which is how long an idle keep-alive connection stays open waiting for the next request, I think that one defaults to 5 seconds. And newer Node versions added headersTimeout and requestTimeout to guard against clients that send data really slowly. That slow trickle thing is basically what a slowloris attack is, the attacker opens a ton of connections and dribbles bytes to exhaust the server's capacity. The general idea with all of these is capping how long any single client can tie up a connection, so a slow or malicious client can't hold resources open forever. You set them on the server object and tune them against how long your legitimate requests and uploads actually take.