From 4269b1618cf82652d31e475ff5a9aabc3b6232a4 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 14 Mar 2026 17:31:38 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Add=20IdleTimeout=20to=20HTTP=20servers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch explicitly sets `IdleTimeout: 120 * time.Second` to `http.Server` configurations in `pkg/auth/oauth.go`, `pkg/channels/manager.go`, and `pkg/health/server.go`. This hardens the servers against slowloris/DoS conditions and potential connection exhaustion by providing an explicit and reliable bound for idle connection lifetimes, independently of read timeouts.

Co-authored-by: hobbyistlabs-coder <267281733+hobbyistlabs-coder@users.noreply.github.com>
---
 pkg/auth/oauth.go       | 1 +
 pkg/channels/manager.go | 1 +
 pkg/health/server.go    | 1 +
 3 files changed, 3 insertions(+)

diff --git a/pkg/auth/oauth.go b/pkg/auth/oauth.go
index 2ba75b0c5..d503d1721 100644
--- a/pkg/auth/oauth.go
+++ b/pkg/auth/oauth.go
@@ -123,6 +123,7 @@ func LoginBrowser(cfg OAuthProviderConfig) (*AuthCredential, error) {
 		ReadTimeout:       10 * time.Second,
 		ReadHeaderTimeout: 5 * time.Second,
 		WriteTimeout:      10 * time.Second,
+		IdleTimeout:       120 * time.Second,
 	}
 	go server.Serve(listener)
 	defer func() {
diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go
index 12924cd56..bf08399f5 100644
--- a/pkg/channels/manager.go
+++ b/pkg/channels/manager.go
@@ -333,6 +333,7 @@ func (m *Manager) SetupHTTPServer(addr string, healthServer *health.Server) {
 		ReadTimeout:       30 * time.Second,
 		ReadHeaderTimeout: 10 * time.Second,
 		WriteTimeout:      30 * time.Second,
+		IdleTimeout:       120 * time.Second,
 	}
 }
 
diff --git a/pkg/health/server.go b/pkg/health/server.go
index a3f6e4df2..632e4c346 100644
--- a/pkg/health/server.go
+++ b/pkg/health/server.go
@@ -49,6 +49,7 @@ func NewServer(host string, port int) *Server {
 		ReadTimeout:       5 * time.Second,
 		ReadHeaderTimeout: 3 * time.Second,
 		WriteTimeout:      5 * time.Second,
+		IdleTimeout:       120 * time.Second,
 	}
 
 	return s