Wt

There are several ways to reduce the risk of a denial of service attack:

• If your application requires authentication, put authentication in a separate form before the application, and check submitted values from the environment.
• Disable reload-is-new-session in the configuration (perhaps use cookies to avoid the ugly session id in the url).
• Use the default bootstrap mode (not the progressive mode) to avoid denial of service attacks using a command-line tool like wget: the application is then only started after a second request which needs to be of the right format.
• There is no way to avoid that one user steals another user's session (an idea such as enforcing client IP addresses does not work for multi-home users and does not work within organizations that sit behind a NAT). If you care about security, use encryption (SSL).
• In any case, provide enough swap space so that unused sessions can be swapped out.