caddyhttp: Set default ReadHeaderTimeout (1 min)

Ref. #6663

Matthew Holt committed Nov 19, 2024 at 11:24 UTC 197c564f2032becba14aeec0152fe5eeb639d6c1

2 files changed +18 -5

modules/caddyhttp/app.go

+17 -5

@@ -401,6 +401,9 @@ func (app *App) Provision(ctx caddy.Context) error {

401 if srv.IdleTimeout == 0 {

402 srv.IdleTimeout = defaultIdleTimeout

403 }

404 + if srv.ReadHeaderTimeout == 0 {

405 + srv.ReadHeaderTimeout = defaultReadHeaderTimeout // see #6663

406 + }

407 }

408 ctx.Context = oldContext

409 return nil

@@ -770,11 +773,20 @@ func (app *App) httpsPort() int {

773 return app.HTTPSPort

774 }

775

773 -// defaultIdleTimeout is the default HTTP server timeout

774 -// for closing idle connections; useful to avoid resource

775 -// exhaustion behind hungry CDNs, for example (we've had

776 -// several complaints without this).

777 -const defaultIdleTimeout = caddy.Duration(5 * time.Minute)

776 +const (

777 + // defaultIdleTimeout is the default HTTP server timeout

778 + // for closing idle connections; useful to avoid resource

779 + // exhaustion behind hungry CDNs, for example (we've had

780 + // several complaints without this).

781 + defaultIdleTimeout = caddy.Duration(5 * time.Minute)

782 +

783 + // defaultReadHeaderTimeout is the default timeout for

784 + // reading HTTP headers from clients. Headers are generally

785 + // small, often less than 1 KB, so it shouldn't take a

786 + // long time even on legitimately slow connections or

787 + // busy servers to read it.

788 + defaultReadHeaderTimeout = caddy.Duration(time.Minute)

789 +)

790

791 // Interface guards

792 var (

modules/caddyhttp/server.go

@@ -61,6 +61,7 @@ type Server struct {

61 ReadTimeout caddy.Duration `json:"read_timeout,omitempty"`

63 // ReadHeaderTimeout is like ReadTimeout but for request headers.

64 + // Default is 1 minute.

65 ReadHeaderTimeout caddy.Duration `json:"read_header_timeout,omitempty"`

67 // WriteTimeout is how long to allow a write to a client. Note