The GET Request That Never Ends: A Denial-of-Service Hiding in Plain Sight

Baibhav Kumar — Mon, 20 Jul 2026 16:34:26 +0000

Picture this: you’ve built an API. Every sensitive route sits behind auth middleware. Then someone sends a single GET request — no login, no token, nothing malicious-looking in any log you'd normally check — and it just... sits there. Not crashing. Not erroring. Just holding a connection open, silently, for as long as your infrastructure lets it.

Do that a few dozen times in parallel, and depending on how your stack is built, you can go from “fully operational” to “refusing every legitimate request” — without ever touching your authentication, without exploiting a single line of business logic, and without leaving behind the kind of error that makes anyone go looking.

This is a Denial of Service (DoS) — one of the oldest, most well-understood attack categories in web security, hiding inside a request that looks, on its face, completely harmless. This post is about why that’s possible, why it’s more possible than most teams assume, and — the part that should actually worry you — why the exact defenses you already believe are protecting you might not be wired up the way you think.

DEV Community: Baibhav Kumar

The GET Request That Never Ends: A Denial-of-Service Hiding in Plain Sight