security: add HTTP server timeouts (ai:gpt-5) #54

New issue

Closed

opened 2026-05-23 22:20:58 +02:00 by heiko · 1 comment

heiko commented

2026-05-23 22:20:58 +02:00

Owner

Finding from a whole-codebase security review.

Affected code:

cmd/once-server/serve.go:142-148 calls http.ListenAndServeTLS or http.ListenAndServe directly with the default server settings.

Impact:
The default net/http server has no ReadHeaderTimeout, ReadTimeout, WriteTimeout, or IdleTimeout. An unauthenticated client can hold connections open slowly and consume server resources, especially when Once is exposed directly or when a reverse proxy does not fully absorb slow clients.

Suggested fix:

Instantiate an http.Server explicitly with conservative timeouts.
Make timeout values configurable if needed, but keep safe defaults.
Keep compatibility with both direct TLS and HTTP-behind-proxy modes.
Add tests or at least configuration coverage for the timeout defaults.

Finding from a whole-codebase security review. Affected code: - cmd/once-server/serve.go:142-148 calls `http.ListenAndServeTLS` or `http.ListenAndServe` directly with the default server settings. Impact: The default `net/http` server has no `ReadHeaderTimeout`, `ReadTimeout`, `WriteTimeout`, or `IdleTimeout`. An unauthenticated client can hold connections open slowly and consume server resources, especially when Once is exposed directly or when a reverse proxy does not fully absorb slow clients. Suggested fix: - Instantiate an `http.Server` explicitly with conservative timeouts. - Make timeout values configurable if needed, but keep safe defaults. - Keep compatibility with both direct TLS and HTTP-behind-proxy modes. - Add tests or at least configuration coverage for the timeout defaults.

heiko referenced this issue from a commit

2026-05-24 17:36:54 +02:00

Add configurable HTTP server timeouts

heiko added the

security

label

2026-05-24 18:44:09 +02:00

heiko referenced this issue from a pull request that will close it,

2026-05-24 18:52:03 +02:00

Fix #54: add HTTP server timeouts #60

heiko commented

2026-05-24 20:15:50 +02:00

Author

Owner

Fixed by commit f407586 (Add configurable HTTP server timeouts).

Implements all four timeouts:

ReadHeaderTimeout: 5s
ReadTimeout: 30s
WriteTimeout: 1m
IdleTimeout: 2m

Timeouts are configurable via TOML config. Security review confirmed proper implementation with comprehensive test coverage.

Fixed by commit f407586 (Add configurable HTTP server timeouts). Implements all four timeouts: - ReadHeaderTimeout: 5s - ReadTimeout: 30s - WriteTimeout: 1m - IdleTimeout: 2m Timeouts are configurable via TOML config. Security review confirmed proper implementation with comprehensive test coverage.

heiko closed this issue

2026-05-24 20:15:59 +02:00

heiko referenced this issue

2026-05-24 20:50:14 +02:00

security: comprehensive fixes for issues #48, #50, #51, #52, #53 ai:claude-sonnet-4-5 #61