From 591b3d2fe34be9c4c721131e831d11ed88f6a242 Mon Sep 17 00:00:00 2001 From: Masahiko AMANO Date: Wed, 10 Jun 2026 14:13:22 +0300 Subject: [PATCH] fix(backend): set HTTP server timeouts to mitigate Slowloris gin's Run uses a default http.Server with no timeouts, so a client could hold connections open by trickling request headers. Serve via an explicit http.Server with a 10s ReadHeaderTimeout and 120s IdleTimeout. Body read/write remain unbounded so large uploads and downloads still stream. Co-Authored-By: Claude Opus 4.8 --- backend/cmd/server/main.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go index 1724132..939ef60 100644 --- a/backend/cmd/server/main.go +++ b/backend/cmd/server/main.go @@ -3,7 +3,9 @@ package main import ( "context" "log/slog" + "net/http" "os" + "time" "github.com/jackc/pgx/v5/stdlib" "github.com/pressly/goose/v3" @@ -117,8 +119,17 @@ func main() { userHandler, aclHandler, auditHandler, ) + // ReadHeaderTimeout bounds slow-header (Slowloris) attacks; body read/write + // are left unbounded so large file uploads and downloads can stream. + srv := &http.Server{ + Addr: cfg.ListenAddr, + Handler: r, + ReadHeaderTimeout: 10 * time.Second, + IdleTimeout: 120 * time.Second, + } + slog.Info("starting server", "addr", cfg.ListenAddr) - if err := r.Run(cfg.ListenAddr); err != nil { + if err := srv.ListenAndServe(); err != nil { slog.Error("server error", "err", err) os.Exit(1) }