Web race condition: Single Packet Attack

Questions
1

So I am currently learning about web-based race conditions and I am kinda stuck.

So my understanding is, that multiple incomplete HTTP packets are sent to the server and THEN they are completed by a single tcp packet containing the rest of the inital HTTP requests(Nagle algo)

I can comprehend, that the HTTP packet with the rest of the first HTTP packet are somehow combined again before/when/after reaching the server(via sending a mapping with it or smth idk)

What I don’t understand:

Why aren’t the inital (30 or so) HTTP requests processed by the server before the rest of the HTTP requests arrive? How are they combined together again? Or are they combined before reaching the server?

I understand, that END_STREAM will be set and the last byte is removed before sending most of the data in the first step, but how does the server know? Why does it care and not just HTTP 500 me or smth?

Any help is apprechiated!

2

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.