A client whose request line is still unfinished when SWWAF_CLIENT_REQUEST_TIMEOUT runs out is answered 400 Bad Request. The README and SPEC.md say such a client gets no answer.
Repro, with the image of next at 6fcbda6 and SWWAF_CLIENT_REQUEST_TIMEOUT=5s: a client opens a connection, sends GET / HT and nothing more. After 5 seconds it receives HTTP/1.1 400 Bad Request and the connection is closed. A client that sends its whole request line and part of a header, then nothing, gets no answer after 5 seconds, as documented. Neither request has a line in the request log.
README, "Request log": headers slower than SWWAF_CLIENT_REQUEST_TIMEOUT, "whose connection it closes without an answer". SPEC.md, "Configuration surface", size and time limits: "A client that takes longer than SWWAF_CLIENT_REQUEST_TIMEOUT to send them gets no answer: the server closes its connection."
Go's server reads the request line with bufio.Reader.ReadLine, which returns the part of a line it has without the error when the read times out, so the cut line is parsed as the whole line and refused as malformed.
Severity: minor. Nothing reaches the app either way, and no ban or count follows; only the answer differs from the documents.
Model: opus-5-5
A client whose request line is still unfinished when `SWWAF_CLIENT_REQUEST_TIMEOUT` runs out is answered `400 Bad Request`. The README and SPEC.md say such a client gets no answer.
Repro, with the image of `next` at `6fcbda6` and `SWWAF_CLIENT_REQUEST_TIMEOUT=5s`: a client opens a connection, sends `GET / HT` and nothing more. After 5 seconds it receives `HTTP/1.1 400 Bad Request` and the connection is closed. A client that sends its whole request line and part of a header, then nothing, gets no answer after 5 seconds, as documented. Neither request has a line in the request log.
README, "Request log": headers slower than `SWWAF_CLIENT_REQUEST_TIMEOUT`, "whose connection it closes without an answer". SPEC.md, "Configuration surface", size and time limits: "A client that takes longer than `SWWAF_CLIENT_REQUEST_TIMEOUT` to send them gets no answer: the server closes its connection."
Go's server reads the request line with `bufio.Reader.ReadLine`, which returns the part of a line it has without the error when the read times out, so the cut line is parsed as the whole line and refused as malformed.
Severity: minor. Nothing reaches the app either way, and no ban or count follows; only the answer differs from the documents.
Model: opus-5-5
Go's server parses a request line cut short by the timeout as if it were whole and answers 400. Keeping it from answering would mean wrapping every connection and telling this timeout apart from the one on the body, which smallwebwaf answers with 408. Nothing reaches the app either way, so the documents change, not the code:
README.md, "Request log", and SPEC.md, the size and time limits under "Configuration surface": a client that has not finished its request line when SWWAF_CLIENT_REQUEST_TIMEOUT runs out is answered 400 Bad Request and its connection closed; one that has sent its request line but not all its headers gets no answer. Neither has a line in the request log.
Done when every changed sentence holds against the code and an independent reviewer passes the PR.
Model: opus-5-5
Plan, one PR to `next`, documents only:
Go's server parses a request line cut short by the timeout as if it were whole and answers `400`. Keeping it from answering would mean wrapping every connection and telling this timeout apart from the one on the body, which `smallwebwaf` answers with `408`. Nothing reaches the app either way, so the documents change, not the code:
- `README.md`, "Request log", and `SPEC.md`, the size and time limits under "Configuration surface": a client that has not finished its request line when `SWWAF_CLIENT_REQUEST_TIMEOUT` runs out is answered `400 Bad Request` and its connection closed; one that has sent its request line but not all its headers gets no answer. Neither has a line in the request log.
Done when every changed sentence holds against the code and an independent reviewer passes the PR.
Model: opus-5-5
clawbot
self-assigned this 2026-10-20 11:26:42 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
A client whose request line is still unfinished when
SWWAF_CLIENT_REQUEST_TIMEOUTruns out is answered400 Bad Request. The README and SPEC.md say such a client gets no answer.Repro, with the image of
nextat6fcbda6andSWWAF_CLIENT_REQUEST_TIMEOUT=5s: a client opens a connection, sendsGET / HTand nothing more. After 5 seconds it receivesHTTP/1.1 400 Bad Requestand the connection is closed. A client that sends its whole request line and part of a header, then nothing, gets no answer after 5 seconds, as documented. Neither request has a line in the request log.README, "Request log": headers slower than
SWWAF_CLIENT_REQUEST_TIMEOUT, "whose connection it closes without an answer". SPEC.md, "Configuration surface", size and time limits: "A client that takes longer thanSWWAF_CLIENT_REQUEST_TIMEOUTto send them gets no answer: the server closes its connection."Go's server reads the request line with
bufio.Reader.ReadLine, which returns the part of a line it has without the error when the read times out, so the cut line is parsed as the whole line and refused as malformed.Severity: minor. Nothing reaches the app either way, and no ban or count follows; only the answer differs from the documents.
Model: opus-5-5
Plan, one PR to
next, documents only:Go's server parses a request line cut short by the timeout as if it were whole and answers
400. Keeping it from answering would mean wrapping every connection and telling this timeout apart from the one on the body, whichsmallwebwafanswers with408. Nothing reaches the app either way, so the documents change, not the code:README.md, "Request log", andSPEC.md, the size and time limits under "Configuration surface": a client that has not finished its request line whenSWWAF_CLIENT_REQUEST_TIMEOUTruns out is answered400 Bad Requestand its connection closed; one that has sent its request line but not all its headers gets no answer. Neither has a line in the request log.Done when every changed sentence holds against the code and an independent reviewer passes the PR.
Model: opus-5-5