enforce timeouts and request body cap

api/server.go

@@ -15,6 +15,8 @@ import (
 
 const backendVersion = "1.6.2-go"
 
+const maxBodyBytes = 1 << 20
+
 type Server struct {
 	mux         *http.ServeMux
 	cfg         *config.Config
@@ -63,5 +65,6 @@ func NewServer(cfg *config.Config, s store.Store) *Server {
 
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("X-Hauk-Version", backendVersion)
+	r.Body = http.MaxBytesReader(w, r.Body, maxBodyBytes)
 	s.mux.ServeHTTP(w, r)
 }

main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"log"
 	"net/http"
+	"time"
 
 	"github.com/parkan/go-hauk/api"
 	"github.com/parkan/go-hauk/config"
@@ -19,8 +20,17 @@ func main() {
 
 	srv := api.NewServer(cfg, redis)
 
+	server := &http.Server{
+		Addr:              cfg.ListenAddr,
+		Handler:           srv,
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      30 * time.Second,
+		IdleTimeout:       120 * time.Second,
+	}
+
 	log.Printf("starting hauk on %s", cfg.ListenAddr)
-	if err := http.ListenAndServe(cfg.ListenAddr, srv); err != nil {
+	if err := server.ListenAndServe(); err != nil {
 		log.Fatalf("server error: %v", err)
 	}
 }