HarperFast / HarperFast/harper

uWS HTTP path silently ignores keepAliveTimeout, timeout and headersTimeout

Open
#2,454 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
89
Forks
10
Avg merge
2d 6h
Merged PRs (30d)
200

Description

On the uWS HTTP path, `keepAliveTimeout`, `timeout` and `headersTimeout` are all silently ignored —
configured values are accepted and have no effect, so connections that would time out under the Node
HTTP server never do.

## Mechanism (harper, `server/http.ts` on `origin/main`)

The `HARPER_UWS_HTTP` branch (guard at ~`:601`, `process.env.HARPER_UWS_HTTP && !secure && !isOperationsServer…`)
builds `uwsServeConfigs[port]` and then `return httpServers[port];` at ~`:615`.

`keepAliveTimeout` (~`:619`), `requestTimeout`/`timeout` (~`:620`) and `headersTimeout` (~`:621`) are
read only in the Node-`http`-server branch immediately **below** that return, which the uWS path
never reaches.

`requestQueueLimit` **is** read and threaded into the uWS handler at ~`:611`
(`env.get(serverPrefix + '_requestQueueLimit')` → `makeUwsHandler`), which is what makes this look
like an oversight rather than a deliberate opt-out: one of the four knobs was wired, three were left
behind the early return.

No commit has touched this region since the gap was first observed (2026-07-25).

## Impact

Slow-loris-shaped connections (headers never completed, idle keep-alive sockets) have no deadline on
the uWS path. Relevance is rising now that harper-pro #609 bundles uWS in official images, though it
still requires `HARPER_UWS_HTTP` on a non-secure, non-operations server.

Related but distinct: #1752 covers three other uWS gaps (onUpgrade auth, Fastify-delegate IP
spoofing, static-buffering OOM) and does not mention timeouts.

## Fix shape

Read the three options before the uWS early return and thread them into the uWS server config the
same way `requestQueueLimit` already is; if uWS genuinely cannot honor one of them, log at startup
that the configured value is inert rather than accepting it silently.

Contributor guide

Open the contributing guide

Research direction

Start in server/http.ts at the HARPER_UWS_HTTP branch around lines 601-621 and compare its uWS configuration with the Node http-server branch below the early return. Trace how requestQueueLimit reaches makeUwsHandler, then determine how the three timeout options can be handled in the uWS configuration. Done means configured values no longer remain silently inert, or startup clearly reports when uWS cannot honor one.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
backend, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.