Harden http.Server: slowloris timeouts and form body limit (closes #92)

The http.Server now sets ReadHeaderTimeout (10s), which bounds the slow header dribble that ReadTimeout alone does not, and IdleTimeout (120s), which bounds keep-alive reuse. Server construction moved into a small helper so a test can assert the timeouts without binding a listener.

POST / and POST /generate bodies are capped at 1 MiB and an oversized body returns 413.

What a reader would trip over: the CSRF library reads its token from the form and swallows a parse error, so a cap applied only inside it would surface as 403. The body limit therefore parses the form under the cap before the CSRF check; the parsed form is reused afterwards. A test covers an oversized body that carries a valid token.

Judgement call: WriteTimeout stays at 60s; it also bounds how long a large image may take to send over a slow link.

Model: opus-4-8 (implementation, review); fable-5-1 (landing message)

internal/server/http_internal_test.go

@@ -0,0 +1,65 @@
+package server
+
+import (
+	"testing"
+	"time"
+
+	"sneak.berlin/go/pixa/internal/config"
+)
+
+// TestNewHTTPServerTimeouts verifies that the constructed http.Server
+// carries every hardening timeout wired onto it, including the slowloris
+// defense (ReadHeaderTimeout) and the keep-alive bound (IdleTimeout). This
+// guards against a field being defined but never set on the server, so
+// each assertion compares the server field to its constant.
+func TestNewHTTPServerTimeouts(t *testing.T) {
+	t.Parallel()
+
+	s := &Server{config: &config.Config{Port: 8080}}
+
+	srv := s.newHTTPServer()
+
+	fields := []struct {
+		name string
+		got  time.Duration
+		want time.Duration
+	}{
+		{"ReadTimeout", srv.ReadTimeout, HTTPReadTimeout},
+		{"ReadHeaderTimeout", srv.ReadHeaderTimeout, HTTPReadHeaderTimeout},
+		{"WriteTimeout", srv.WriteTimeout, HTTPWriteTimeout},
+		{"IdleTimeout", srv.IdleTimeout, HTTPIdleTimeout},
+	}
+
+	for _, f := range fields {
+		if f.got != f.want {
+			t.Errorf("%s = %v, want %v", f.name, f.got, f.want)
+		}
+	}
+
+	if srv.MaxHeaderBytes != HTTPMaxHeaderBytes {
+		t.Errorf("MaxHeaderBytes = %d, want %d",
+			srv.MaxHeaderBytes, HTTPMaxHeaderBytes)
+	}
+
+	if srv.Handler != s {
+		t.Error("Handler is not the server")
+	}
+}
+
+// TestHardeningTimeoutValues pins the intent behind the two new timeouts
+// without hard-coding brittle exact durations: the header-read phase is
+// bounded strictly shorter than the whole-request read (the slowloris
+// dribble), and idle keep-alive connections are bounded rather than held
+// open forever.
+func TestHardeningTimeoutValues(t *testing.T) {
+	t.Parallel()
+
+	if HTTPReadHeaderTimeout <= 0 || HTTPReadHeaderTimeout > HTTPReadTimeout {
+		t.Errorf("ReadHeaderTimeout = %v, want positive and <= ReadTimeout %v",
+			HTTPReadHeaderTimeout, HTTPReadTimeout)
+	}
+
+	if HTTPIdleTimeout <= 0 {
+		t.Errorf("IdleTimeout = %v, want positive bound", HTTPIdleTimeout)
+	}
+}