Merge pull request #7 from hobbyistlabs-coder/sentinel-security-fix-http-server-timeouts-12894386082144780078

🛡️ Sentinel: [MEDIUM] Fix missing timeouts on HTTP servers

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2025-02-28 - [Medium] Fix Missing HTTP Server Timeouts
+**Vulnerability:** Go's standard `http.ListenAndServe` and unconfigured `http.Server` instances lack default timeouts for reading headers, reading bodies, and writing responses.
+**Learning:** These default settings leave the application vulnerable to resource exhaustion and Denial of Service (DoS) attacks, such as Slowloris, because malicious clients can slowly send data and tie up server connections indefinitely.
+**Prevention:** Always instantiate `http.Server` explicitly and set `ReadHeaderTimeout`, `ReadTimeout`, `WriteTimeout`, and (optionally) `IdleTimeout` to reasonable values based on the expected request sizes and latencies.

pkg/auth/oauth.go

@@ -118,7 +118,12 @@ func LoginBrowser(cfg OAuthProviderConfig) (*AuthCredential, error) {
 		return nil, fmt.Errorf("starting callback server on port %d: %w", cfg.Port, err)
 	}
 
-	server := &http.Server{Handler: mux}
+	server := &http.Server{
+		Handler:           mux,
+		ReadTimeout:       10 * time.Second,
+		ReadHeaderTimeout: 5 * time.Second,
+		WriteTimeout:      10 * time.Second,
+	}
 	go server.Serve(listener)
 	defer func() {
 		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)

pkg/channels/manager.go

@@ -347,6 +347,7 @@ func (m *Manager) SetupHTTPServer(addr string, healthServer *health.Server) {
 		Addr:              addr,
 		Handler:           m.mux,
 		ReadTimeout:       30 * time.Second,
+		ReadHeaderTimeout: 10 * time.Second,
 		WriteTimeout:      30 * time.Second,
 	}
 }

pkg/health/server.go

@@ -47,6 +47,7 @@ func NewServer(host string, port int) *Server {
 		Addr:              addr,
 		Handler:           mux,
 		ReadTimeout:       5 * time.Second,
+		ReadHeaderTimeout: 3 * time.Second,
 		WriteTimeout:      5 * time.Second,
 	}
 

web/backend/main.go

@@ -163,7 +163,16 @@ func main() {
 	}()
 
 	// Start the Server
-	if err := http.ListenAndServe(addr, handler); err != nil {
+	server := &http.Server{
+		Addr:              addr,
+		Handler:           handler,
+		ReadTimeout:       10 * time.Second,
+		ReadHeaderTimeout: 5 * time.Second,
+		WriteTimeout:      30 * time.Second,
+		IdleTimeout:       120 * time.Second,
+	}
+
+	if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 		log.Fatalf("Server failed to start: %v", err)
 	}
 }