Files
multica/server/cmd
importcppandClaude Fable 5 d540eb6fe7 MUL-6783: perf(server): set read-header and idle timeouts on main HTTP server (#7683)
* perf(server): set read-header and idle timeouts on main HTTP server

The main HTTP server was constructed with only Addr and Handler, so
ReadHeaderTimeout and IdleTimeout defaulted to zero (never time out). A
slow or half-open client that dribbles request headers pins a goroutine
and its read buffer indefinitely (Slowloris), and idle keep-alive
connections are never reclaimed. The sibling metrics and profiling
servers already set these.

Set ReadHeaderTimeout to 5s (matching those servers) and IdleTimeout to
120s (looser than their 30s, since this listener serves keep-alive-heavy
browser/CLI/daemon clients). ReadTimeout and WriteTimeout are left unset
on purpose: WebSocket upgrades (/ws, /api/daemon/ws) share this listener
and a global read/write deadline would kill those long-lived
connections — the same reason the profiling server omits them.

Co-Authored-By: Claude Fable 5 <[email protected]>

* test(server): pin main HTTP server timeout defaults

Extract the public HTTP server construction into newMainHTTPServer and add
a regression test asserting the production timeout defaults: ReadHeaderTimeout
5s, IdleTimeout 120s, and ReadTimeout/WriteTimeout deliberately zero.

These are safety settings — without the test, removing them, zeroing them, or
making the whole-request deadlines non-zero (which would break WebSocket
upgrades and large uploads) would pass CI silently.

Addresses review feedback on #7683.

Co-Authored-By: Claude Fable 5 <[email protected]>

---------

Co-authored-by: Claude Fable 5 <[email protected]>
2026-08-31 12:28:52 +08:00
..