From ae321a216d365ce19dddd6b1c0ffafd5a5020c53 Mon Sep 17 00:00:00 2001 From: eleksir Date: Sat, 4 Apr 2026 16:08:57 +0300 Subject: [PATCH] Explicitly hardcode MaxHeaderBytes as 1k, to prevent slowloris attack --- internal/backer/consts.go | 3 +++ internal/backer/newServer.go | 2 ++ 2 files changed, 5 insertions(+) diff --git a/internal/backer/consts.go b/internal/backer/consts.go index a370942..fb31111 100644 --- a/internal/backer/consts.go +++ b/internal/backer/consts.go @@ -11,6 +11,9 @@ const ( // copyBufferSize is the buffer size used for streaming file contents. copyBufferSize = 32 * 1024 + // maxHeaderBytes is the maximum size of request headers (1KB). + maxHeaderBytes = 1024 + // portMin is the minimum valid port number. portMin = 1 diff --git a/internal/backer/newServer.go b/internal/backer/newServer.go index 4bfab75..549a377 100644 --- a/internal/backer/newServer.go +++ b/internal/backer/newServer.go @@ -184,6 +184,7 @@ func NewServer(configPath string) (*ServerWrapper, error) { Handler: withServerHeader(mux), ReadHeaderTimeout: readHeaderTimeout, WriteTimeout: time.Duration(C.BackupTimeout) * time.Minute, + MaxHeaderBytes: maxHeaderBytes, ErrorLog: log.DebugLogger(), }, }, nil @@ -195,6 +196,7 @@ func NewServer(configPath string) (*ServerWrapper, error) { Handler: withServerHeader(mux), ReadHeaderTimeout: readHeaderTimeout, WriteTimeout: time.Duration(C.BackupTimeout) * time.Minute, + MaxHeaderBytes: maxHeaderBytes, TLSConfig: &tls.Config{ MinVersion: tls.VersionTLS13, },