fix(api): remove ReadTimeout to prevent premature body-read failures under high concurrency - #3416
Open
AdaAibaby wants to merge 1 commit into
Open
fix(api): remove ReadTimeout to prevent premature body-read failures under high concurrency#3416AdaAibaby wants to merge 1 commit into
AdaAibaby wants to merge 1 commit into
Conversation
…under load ReadTimeout: 10s starts counting from TCP connection acceptance, including time the goroutine spends queued in the scheduler. Under high concurrency (hundreds of simultaneous requests) goroutines can wait >10s before being scheduled to read the body, causing the connection to be killed mid-read with an i/o timeout error. This conflicts with requestTimeout: 70s, the intended per-request deadline. ReadTimeout is meant to bound the entire read phase but it becomes the binding constraint under load — not because clients are slow, but because the server scheduler cannot drain the goroutine queue fast enough. ReadHeaderTimeout: 5s is kept to guard against slowloris header attacks. Request bodies on this API are small JSON payloads sent in a single TCP segment, so there is no meaningful slow-body attack surface once headers are received. The requestTimeout middleware context (70s) provides the real per-request ceiling for handler execution.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3415
Summary
ReadTimeout: maxReadTimeout(10s) fromhttp.Serverinpackages/api/main.gomaxReadTimeoutconstantReadHeaderTimeout: 5sis retained for slowloris protectionWhy
ReadTimeoutstarts from TCP accept, including scheduler queue time. Under high concurrency goroutines queue for >10s before being scheduled, so the deadline fires beforeio.ReadAllever executes — producingi/o timeouterrors that look like client disconnects or auth failures. The intended per-request ceiling isrequestTimeout: 70s(middleware context deadline), which is never reached in practice becauseReadTimeoutfires first.Request bodies on this API are small JSON payloads sent in a single TCP segment. Once headers arrive (guarded by
ReadHeaderTimeout), there is no meaningful slow-body attack surface to protect against.Test plan
go build ./packages/api/...i/o timeoutbody-read errors disappear from logs/healthstill responds correctly under loadReadHeaderTimeout)/cc @jakubno @dobrac @ValentaTomas @arkamar @tvi Looking forward to your code review.