🛡️ Sentinel: [MEDIUM] Add IdleTimeout to HTTP servers

This patch explicitly sets `IdleTimeout: 120 * time.Second` to `http.Server` configurations in `pkg/auth/oauth.go`, `pkg/channels/manager.go`, and `pkg/health/server.go`. This hardens the servers against slowloris/DoS conditions and potential connection exhaustion by providing an explicit and reliable bound for idle connection lifetimes, independently of read timeouts.

Co-authored-by: hobbyistlabs-coder <267281733+hobbyistlabs-coder@users.noreply.github.com>

pkg/auth/oauth.go

@@ -123,6 +123,7 @@ func LoginBrowser(cfg OAuthProviderConfig) (*AuthCredential, error) {
 		ReadTimeout:       10 * time.Second,
 		ReadHeaderTimeout: 5 * time.Second,
 		WriteTimeout:      10 * time.Second,
+		IdleTimeout:       120 * time.Second,
 	}
 	go server.Serve(listener)
 	defer func() {

pkg/channels/manager.go

@@ -333,6 +333,7 @@ func (m *Manager) SetupHTTPServer(addr string, healthServer *health.Server) {
 		ReadTimeout:       30 * time.Second,
 		ReadHeaderTimeout: 10 * time.Second,
 		WriteTimeout:      30 * time.Second,
+		IdleTimeout:       120 * time.Second,
 	}
 }
 

pkg/health/server.go

@@ -49,6 +49,7 @@ func NewServer(host string, port int) *Server {
 		ReadTimeout:       5 * time.Second,
 		ReadHeaderTimeout: 3 * time.Second,
 		WriteTimeout:      5 * time.Second,
+		IdleTimeout:       120 * time.Second,
 	}
 
 	return s