From f8d2d79394e267190abf8357d27b26d0c7baac35 Mon Sep 17 00:00:00 2001 From: silverwind Date: Wed, 12 Aug 2026 12:42:26 +0200 Subject: [PATCH] fix(server): set `ReadHeaderTimeout` on HTTP servers (#38878) Add `ReadHeaderTimeout` which limits how long a client can take to send HTTP headers. --- cmd/web.go | 3 ++- modules/graceful/server_http.go | 8 +++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/cmd/web.go b/cmd/web.go index 5644f37d232..de886e03296 100644 --- a/cmd/web.go +++ b/cmd/web.go @@ -244,7 +244,8 @@ func servePprof() { _, _, finished := process.GetManager().AddTypedContext(context.TODO(), "Web: PProf Server", process.SystemProcessType, true) // The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment, it's not worth introducing a configurable option for it. log.Info("Starting pprof server on localhost:6060") - log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", mux)) + server := &http.Server{Addr: "localhost:6060", Handler: mux, ReadHeaderTimeout: 10 * time.Second} + log.Info("Stopped pprof server: %v", server.ListenAndServe()) finished() } diff --git a/modules/graceful/server_http.go b/modules/graceful/server_http.go index 77a2c3b6f83..8f11ab691c1 100644 --- a/modules/graceful/server_http.go +++ b/modules/graceful/server_http.go @@ -8,6 +8,7 @@ import ( "crypto/tls" "net" "net/http" + "time" ) func newHTTPServer(network, address, name string, handler http.Handler) (*Server, ServeFunction) { @@ -17,9 +18,10 @@ func newHTTPServer(network, address, name string, handler http.Handler) (*Server protocols.SetHTTP2(true) // HTTP/2 can only be used when Gitea is configured to use TLS protocols.SetUnencryptedHTTP2(true) // Allow HTTP/2 without TLS, in case Gitea is behind a reverse proxy httpServer := http.Server{ - Protocols: &protocols, - Handler: handler, - BaseContext: func(net.Listener) context.Context { return GetManager().HammerContext() }, + Protocols: &protocols, + Handler: handler, + BaseContext: func(net.Listener) context.Context { return GetManager().HammerContext() }, + ReadHeaderTimeout: 10 * time.Second, } server.OnShutdown = func() { httpServer.SetKeepAlivesEnabled(false)