clawbot
37d49ade11
check / check (push) Failing after 1s
The http.Server now sets ReadHeaderTimeout (10s), which bounds the slow header dribble that ReadTimeout alone does not, and IdleTimeout (120s), which bounds keep-alive reuse. Server construction moved into a small helper so a test can assert the timeouts without binding a listener. POST / and POST /generate bodies are capped at 1 MiB and an oversized body returns 413. What a reader would trip over: the CSRF library reads its token from the form and swallows a parse error, so a cap applied only inside it would surface as 403. The body limit therefore parses the form under the cap before the CSRF check; the parsed form is reused afterwards. A test covers an oversized body that carries a valid token. Judgement call: WriteTimeout stays at 60s; it also bounds how long a large image may take to send over a slow link. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)