zakirkun Missing Network Timeout
Overview
Network connections without timeouts are vulnerable to:
- Slowloris: Attacker opens connections and sends headers slowly, exhausting connection pool
- Resource exhaustion: Long-running connections hold goroutines/threads indefinitely
- Hanging requests: A slow external service stalls all users waiting for responses
Remediation
- Set connect timeout, read timeout, and write timeout independently
- Use context with deadline for all outbound HTTP requests
- Configure server read/write timeouts
Safe (Go):
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
req, _ := http.NewRequestWithContext(ctx, "GET", url, nil)