clawbot
f3895789d2
check / check (push) Failing after 1s
Add ReadHeaderTimeout and IdleTimeout to the http.Server as named constants beside the existing timeouts. Add a SecurityHeaders middleware (HSTS, a JSON-API CSP of default-src 'none'; frame-ancestors 'none', X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy), registered before CORS so preflight responses carry it. Resolve the client IP from X-Forwarded-For / X-Real-IP only when the direct peer is in the trusted-proxy allowlist (loopback plus RFC1918 by default, configurable via TRUSTED_PROXIES); an untrusted peer's forwarded headers are ignored. Uses net/netip; no new dependency. Model: opus-4-8 (implementation and review); claude-fable-5 (merge)
48 lines
993 B
Go
48 lines
993 B
Go
package server
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
readTimeout = 10 * time.Second
|
|
readHeaderTimeout = 5 * time.Second
|
|
writeTimeout = 10 * time.Second
|
|
idleTimeout = 60 * time.Second
|
|
maxHeaderBytes = 1 << 20 // 1 MiB
|
|
)
|
|
|
|
func (s *Server) serveUntilShutdown() {
|
|
listenAddr := fmt.Sprintf(":%d", s.params.Config.Port)
|
|
|
|
s.httpServer = &http.Server{
|
|
Addr: listenAddr,
|
|
Handler: s,
|
|
MaxHeaderBytes: maxHeaderBytes,
|
|
ReadTimeout: readTimeout,
|
|
ReadHeaderTimeout: readHeaderTimeout,
|
|
WriteTimeout: writeTimeout,
|
|
IdleTimeout: idleTimeout,
|
|
}
|
|
|
|
s.SetupRoutes()
|
|
|
|
s.log.Info("http begin listen",
|
|
"listenaddr", listenAddr,
|
|
"version", s.params.Globals.Version,
|
|
"buildarch", s.params.Globals.Buildarch,
|
|
)
|
|
|
|
err := s.httpServer.ListenAndServe()
|
|
if err != nil && !errors.Is(err, http.ErrServerClosed) {
|
|
s.log.Error("listen error", "error", err)
|
|
|
|
if s.cancelFunc != nil {
|
|
s.cancelFunc()
|
|
}
|
|
}
|
|
}
|