Beast Attack in Fiber (Go)

The Beast Attack refers to a class of HTTP/2-level denial‑of‑service attacks that exploit how servers handle concurrent stream prioritization and window size adjustments. When a vulnerable endpoint runs on Go using the Fiber framework, the framework inherits the underlying Go net/http server's handling of HTTP/2 frames. If the server does not correctly configure stream limits or fails to enforce back‑pressure, an attacker can open a large number of streams simultaneously and send incremental data frames that keep the connection open without consuming significant memory on the server.

In a typical Fiber application, the HTTP/2 server settings are controlled by the Go runtime. By default, Go allows up to 100 concurrent streams per connection, but the window size for each stream can be set to a very large value, allowing the client to send a massive amount of data before the server updates its flow control window. This combination enables an attacker to perform a Beast Attack where the client inflates the number of open streams and gradually consumes server resources such as CPU, memory, and file descriptors. The attack is especially effective when the API endpoint processes large request bodies or streams file uploads, because each stream can be used to read chunked data without completing the request, leading to resource exhaustion.

Although the underlying HTTP/2 implementation is part of Go, the Fiber framework does not provide its own independent rate‑limiting or flow‑control mechanisms. Therefore, the responsibility for securing the endpoint against stream‑based abuse falls on the developer using Go. Misconfigurations such as setting MaxConcurrentStreams too high, omitting explicit ReadTimeout values, or not limiting the size of uploaded files amplify the risk. When these settings are left at their defaults, a malicious client can keep the connection alive indefinitely, effectively performing a Beast Attack that degrades service for legitimate users.

To mitigate the Beast Attack in a Fiber application written in Go, developers must explicitly enforce limits on stream concurrency, window size, and request body parsing. Below is a concrete example of configuring a Fiber server with safe HTTP/2 settings:

package main

import (
    "log"
    "github.com/gofiber/fiber/v2"
    "github.com/gofiber/fiber/v2/middleware/limiter"
    "github.com/gofiber/fiber/v2/adaptor"
    "golang.org/x/net/http2"
)

func main() {
    // Create a new Fiber instance
    app := fiber.New(fiber.Config{
        // Enable HTTP/2 support
        HTTP2Enabled: true,
        // Limit concurrent streams per connection
        // This maps to http2.Server.MaxConcurrentStreams
        MaxConcurrentStreams: 25,
        // Reduce the default window size to prevent unlimited data flow
        // This maps to http2.Server.WindowSize
        // Fiber does not expose this directly, so we use a custom server
    })

    // Apply a global rate limiter to further restrict request volume
    app.Use(limiter(NewLimiter()))

    // Example endpoint
    app.Post("/upload", func(c *fiber.Ctx) error {
        // Limit request body size to 10MB
        c.SetBodyLimit(10 << 20)
        return c.SendString("upload received")
    })

    // Create a custom http.Server to set low-level HTTP/2 parameters
    server := &amp;http.Server{
        Addr:    "0.0.0.0:3000",
        Handler: adaptor.New(app),
        // Apply HTTP/2 settings
        // MaxConcurrentStreams limits how many streams a client can open
        // This is set via the http2.Server configuration
        TLSConfig: &tls.Config{
            // Optional: enforce TLS 1.2+ for security
            MinVersion: tls.VersionTLS12,
        },
        // ReadHeaderTimeout controls how long the server waits for the request header
        ReadHeaderTimeout: 5 * time.Second,
        // ReadTimeout ensures that a partially received body does not linger indefinitely
        ReadTimeout:       15 * time.Second,
        // IdleTimeout closes idle connections after a short period
        IdleTimeout:       30 * time.Second,
    }

    // Use the custom server with the Fiber adaptor
    log.Fatal(server.ListenAndServe())
}

// NewLimiter creates a rate limiter middleware that caps requests per second
func NewLimiter() limiter.Config {
    return limiter.Config{
        // Limit to 100 requests per second per IP
        MaxRequests: 100,
        // How long the request count window is
        Per:           1 * time.Second,
        // Optional: define a burst size
        Burst:         20,
    }
}

Key takeaways from the snippet:

• Setting MaxConcurrentStreams to a modest value (e.g., 25) restricts the number of simultaneous streams a client can open, directly limiting the attack surface for a Beast Attack.
• Enforcing a ReadTimeout ensures that partially received request bodies are discarded after a short interval, preventing an attacker from holding connections open indefinitely.
• Limiting the request body size with c.SetBodyLimit stops large uploads from exhausting disk or memory resources.
• Applying a rate‑limiter middleware adds an additional layer of protection by capping the number of requests per second per client IP.

By combining these Go‑level configurations with Fiber’s middleware, developers can dramatically reduce the likelihood of a Beast Attack succeeding against their API endpoints.