In order to defend against slow-client (Slowloris) attacks, reasonable timeouts are necessary but not sufficient if your server has a limited pool of request handlers (or if it uses a separate resource-intensive process/thread per connection). You need a HTTP server (or proxy such as nginx) that buffers incoming requests using async IO syscalls (e.g., `epoll` or at least `select`) until a complete request is ready to be handled by the application.

Even with async IO buffering requests it's still possible for a slow-client DoS to exhaust other system resources (such as file descriptors), but with properly-tuned limits the required attack will need to be many orders of magnitude greater to succeed.