This is a behavior change and should be marked as such in the release notes.

O_o why was keepalive off to begin with?

O_o why was keepalive off to begin with?

I was asking myself the same question a few weeks ago. Especially when using Apache as an SSL-terminating reverse proxy the KeepAlive option makes a very noticeable difference in latency. IMHO this should always have been On by default, with the option to disable it on a vhost basis. I'll submit a PR for the latter.

I have submitted PR #1447.

I reckon the reason is that when this module started out 2.2 was still the default on most platforms.
we had _very bad_ defaults, wrt performance, and sometimes even security, in 2.0 and 2.2

after 2.4 came out, most distros (and, i include this module in that umbrella) were put on a spot to support this strange new behaviour (secure, fast, incompatible ;)

okay, so i went back and checked. keepalive has been On since 1.3
what's going on here??

@igalic @antaflos with the changes merged with #1447 is there any need for this pr ?

@tphoney yes, this should be merged into 2.x

Opinion: I think reasonable default performance-wise and security-wise changes can go in 1.x.

This is like 932f0d0 to me.

…except that with keepalive on (and the wrong keepalivetimeout setting [and the wrong mpm]) you're exposing yourself to resource starvation attacks