We have been recommended to enable keep alive to increase site speed. However, our infrastructure team have mentioned the following security concern:
This could be used for a denial of service attack if it is not handled properly. If these keep alive sessions effectively last, say for 10 minutes, the server has to keep this connection open for 10 minutes regardless whether any requests or responses are being made. This alone would take up unnecessary server resources that could be used for active connections. An attacker could create multiple TCP connections to a server to overload it with requests to the point it cannot handle anymore because of these open sessions.
Is this something that anyone has considered and if so, is a 5 second connection worth it?