Explicitly hardcode MaxHeaderBytes as 1k, to prevent slowloris attack

internal/backer/consts.go

@@ -11,6 +11,9 @@ const (
 	// copyBufferSize is the buffer size used for streaming file contents.
 	copyBufferSize = 32 * 1024
 
+	// maxHeaderBytes is the maximum size of request headers (1KB).
+	maxHeaderBytes = 1024
+
 	// portMin is the minimum valid port number.
 	portMin = 1
 

internal/backer/newServer.go

@@ -184,6 +184,7 @@ func NewServer(configPath string) (*ServerWrapper, error) {
 				Handler:           withServerHeader(mux),
 				ReadHeaderTimeout: readHeaderTimeout,
 				WriteTimeout:      time.Duration(C.BackupTimeout) * time.Minute,
+				MaxHeaderBytes:    maxHeaderBytes,
 				ErrorLog:          log.DebugLogger(),
 			},
 		}, nil
@@ -195,6 +196,7 @@ func NewServer(configPath string) (*ServerWrapper, error) {
 			Handler:           withServerHeader(mux),
 			ReadHeaderTimeout: readHeaderTimeout,
 			WriteTimeout:      time.Duration(C.BackupTimeout) * time.Minute,
+			MaxHeaderBytes:    maxHeaderBytes,
 			TLSConfig: &tls.Config{
 				MinVersion: tls.VersionTLS13,
 			},