Server Timeouts, Limits & Hardening

import { createServer } from 'node:http';
import { connect } from 'node:net';

const server = createServer({
  headersTimeout: 1_000,              // whole header block must arrive in 1 s
  requestTimeout: 3_000,              // whole request (headers + body) in 3 s
  keepAliveTimeout: 5_000,            // idle keep-alive connections closed after 5 s
  connectionsCheckingInterval: 250,   // how often the two timeouts above are checked
  maxHeaderSize: 8 * 1024,            // 8 KiB of request headers at most
}, (req, res) => {
  res.end('ok\n');
});
server.maxHeadersCount = 50;          // at most 50 header fields
server.maxRequestsPerSocket = 100;    // recycle a keep-alive socket after 100 requests

server.listen(0, '127.0.0.1', () => {
  const { port } = server.address();
  // A "slowloris" client: send a partial header block, then stall.
  const socket = connect(port, '127.0.0.1');
  socket.setEncoding('latin1');
  const started = Date.now();
  let response = '';
  socket.on('data', (chunk) => { response += chunk; });
  socket.on('close', () => {
    console.log(`closed after ~${Math.round((Date.now() - started) / 100) / 10} s`);
    console.log(response.split('\r\n')[0]);
    server.close();
  });
  socket.write('GET / HTTP/1.1\r\nHost: localhost\r\nX-Slow: 1\r\n'); // never sends the blank line
});

closed after ~1 s
HTTP/1.1 408 Request Timeout

import { createServer } from 'node:http';
import { connect } from 'node:net';
import { setTimeout as sleep } from 'node:timers/promises';

const server = createServer({
  headersTimeout: 1_000,
  requestTimeout: 1_500,            // a 1-byte-per-second upload cannot finish in time
  connectionsCheckingInterval: 250,
}, async (req, res) => {
  try {
    for await (const chunk of req) { /* consume */ }
    res.end('done\n');
  } catch (err) {
    console.log('handler saw:', err.code ?? err.message);
  }
});

server.listen(0, '127.0.0.1', async () => {
  const { port } = server.address();
  const socket = connect(port, '127.0.0.1');
  socket.setEncoding('latin1');
  let response = '';
  socket.on('data', (c) => { response += c; });
  socket.on('error', () => {});
  socket.on('close', () => {
    console.log('client got:', response.split('\r\n')[0] || '(connection closed, no response)');
    server.close();
  });
  // Headers are complete (so headersTimeout is satisfied) but the body trickles.
  socket.write('POST / HTTP/1.1\r\nHost: x\r\nContent-Length: 100\r\n\r\n');
  for (let i = 0; i < 10 && !socket.destroyed; i++) {
    socket.write('a');
    await sleep(500);
  }
});

handler saw: ECONNRESET
client got: HTTP/1.1 408 Request Timeout

import { createServer } from 'node:http';
import { connect } from 'node:net';

const server = createServer({ maxHeaderSize: 2048 }, (req, res) => res.end('ok\n'));
server.maxHeadersCount = 10;

function raw(port, text) {
  return new Promise((resolve) => {
    const socket = connect(port, '127.0.0.1');
    let data = '';
    socket.setEncoding('latin1');
    socket.on('data', (c) => { data += c; });
    socket.on('close', () => resolve(data.split('\r\n')[0]));
    socket.write(text);
  });
}

server.listen(0, '127.0.0.1', async () => {
  const { port } = server.address();
  const head = 'GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n';
  console.log('normal      :', await raw(port, `${head}\r\n`));
  console.log('big header  :', await raw(port, `${head}X-Big: ${'a'.repeat(4096)}\r\n\r\n`));
  const many = Array.from({ length: 30 }, (_, i) => `X-H${i}: 1\r\n`).join('');
  console.log('many headers:', await raw(port, `${head}${many}\r\n`));
  server.close();
});

normal      : HTTP/1.1 200 OK
big header  : HTTP/1.1 431 Request Header Fields Too Large
many headers: HTTP/1.1 431 Request Header Fields Too Large

import { createServer, request } from 'node:http';

const MAX_BODY = 1024; // bytes

class PayloadTooLarge extends Error {
  statusCode = 413;
}

async function readJson(req, limit = MAX_BODY) {
  // Cheap early rejection: believe Content-Length only to say "no", never to say "yes".
  const declared = Number(req.headers['content-length']);
  if (declared > limit) throw new PayloadTooLarge('declared body too large');

  const chunks = [];
  let received = 0;
  for await (const chunk of req) {           // the stream applies backpressure for us
    received += chunk.length;
    if (received > limit) throw new PayloadTooLarge('body too large'); // also covers chunked bodies
    chunks.push(chunk);
  }
  return JSON.parse(Buffer.concat(chunks).toString('utf8'));
}

const server = createServer(async (req, res) => {
  try {
    const body = await readJson(req);
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ keys: Object.keys(body) }));
  } catch (err) {
    const status = err.statusCode ?? (err instanceof SyntaxError ? 400 : 500);
    res.writeHead(status, { 'Content-Type': 'application/json', Connection: 'close' });
    res.end(JSON.stringify({ error: err.message }));
  }
});

server.listen(0, '127.0.0.1', async () => {
  const { port } = server.address();
  const send = (body, headers = {}) => new Promise((resolve) => {
    const req = request({ port, method: 'POST', headers }, (res) => {
      let data = '';
      res.on('data', (c) => { data += c; });
      res.on('end', () => resolve(`${res.statusCode} ${data}`));
    });
    req.on('error', (e) => resolve(`client error ${e.code}`));
    req.end(body);
  });
  console.log('small  :', await send(JSON.stringify({ title: 'Dune' })));
  console.log('large  :', await send(JSON.stringify({ blob: 'x'.repeat(5000) })));
  // Transfer-Encoding: chunked (no Content-Length) is only caught by the counting loop.
  const chunked = new Promise((resolve) => {
    const req = request({ port, method: 'POST' }, (res) => {
      let data = '';
      res.on('data', (c) => { data += c; });
      res.on('end', () => resolve(`${res.statusCode} ${data}`));
    });
    req.on('error', (e) => resolve(`client error ${e.code}`));
    req.write('{"blob":"');
    req.write('x'.repeat(5000));
    req.end('"}');
  });
  console.log('chunked:', await chunked);
  server.close();
});

small  : 200 {"keys":["title"]}
large  : 413 {"error":"declared body too large"}
chunked: 413 {"error":"body too large"}

import express from 'express';
import Fastify from 'fastify';

// Express 5: express.json() enforces a body limit (default '100kb') and the error maps to 413.
const app = express();
app.use(express.json({ limit: '10kb' }));
app.post('/', (req, res) => res.json({ ok: true }));
const expressServer = app.listen(0, '127.0.0.1');
// app.listen() returns the plain node:http server, so every knob from this page applies to it.
expressServer.headersTimeout = 15_000;
expressServer.requestTimeout = 60_000;

// Fastify 5: bodyLimit defaults to 1 MiB; requestTimeout defaults to 0 (no limit!), so set it yourself.
const fastify = Fastify({ bodyLimit: 10 * 1024, requestTimeout: 60_000, keepAliveTimeout: 72_000 });
fastify.post('/', async () => ({ ok: true }));
await fastify.listen({ port: 0, host: '127.0.0.1' });

const big = JSON.stringify({ blob: 'x'.repeat(20_000) });
const post = (server) => fetch(`http://127.0.0.1:${server.address().port}/`, {
  method: 'POST', headers: { 'content-type': 'application/json' }, body: big,
}).then((r) => r.status);

console.log('express  ->', await post(expressServer));
console.log('fastify  ->', await post(fastify.server));
console.log('fastify defaults:', Fastify().server.requestTimeout, Fastify().server.keepAliveTimeout);
expressServer.close();
await fastify.close();

express  -> 413
fastify  -> 413
fastify defaults: 0 72000

import { createServer, request } from 'node:http';
import { BlockList, isIP } from 'node:net';

// Addresses of the reverse proxies we operate (here: the loopback range, for the demo).
function makeClientIp(trustedCidrs) {
  const trusted = new BlockList();
  for (const cidr of trustedCidrs) {
    const [address, prefix] = cidr.split('/');
    trusted.addSubnet(address, Number(prefix), isIP(address) === 6 ? 'ipv6' : 'ipv4');
  }
  const isTrusted = (address) =>
    isIP(address) !== 0 && trusted.check(address, isIP(address) === 6 ? 'ipv6' : 'ipv4');

  return function clientIp(req) {
    const forwarded = (req.headers['x-forwarded-for'] ?? '').split(',').map((h) => h.trim()).filter(Boolean);
    const chain = [...forwarded, req.socket.remoteAddress];  // the TCP peer is the last link
    // Walk from the right: skip addresses that are our own proxies, stop at the first stranger.
    for (let i = chain.length - 1; i >= 0; i--) {
      if (!isTrusted(chain[i]) || i === 0) return chain[i];
    }
  };
}

const clientIp = makeClientIp(['127.0.0.0/8', '::1/128']);

const app = createServer((req, res) => {
  res.setHeader('Content-Type', 'application/json');
  res.end(JSON.stringify({ peer: req.socket.remoteAddress, client: clientIp(req) }) + '\n');
});

app.listen(0, '127.0.0.1', () => {
  const { port } = app.address();
  const get = (xff) => new Promise((resolve) => {
    request({ port, headers: xff ? { 'X-Forwarded-For': xff } : {} }, (res) => {
      let body = '';
      res.on('data', (c) => { body += c; });
      res.on('end', () => resolve(body.trim()));
    }).end();
  });
  (async () => {
    // The proxy (127.0.0.1 here) appended the address it saw, 203.0.113.7.
    console.log(await get('203.0.113.7'));           // honest client
    console.log(await get('1.2.3.4, 203.0.113.7'));  // client lied: the left entry is ignored
    console.log(await get(''));                       // no header: the peer itself
    app.close();
  })();
});

{"peer":"127.0.0.1","client":"203.0.113.7"}
{"peer":"127.0.0.1","client":"203.0.113.7"}
{"peer":"127.0.0.1","client":"127.0.0.1"}

import express from 'express';
import { request } from 'node:http';

const app = express();
app.set('trust proxy', 'loopback');           // trust only proxies at these addresses (also: 1, CIDR lists, a function)
app.get('/', (req, res) => {
  res.json({ ip: req.ip, ips: req.ips, protocol: req.protocol, host: req.host });
});

const server = app.listen(0, '127.0.0.1', () => {
  const { port } = server.address();
  const headers = {
    'X-Forwarded-For': '1.2.3.4, 203.0.113.7',   // "1.2.3.4" was supplied by the client
    'X-Forwarded-Proto': 'https',
    'X-Forwarded-Host': 'books.example.com',
  };
  request({ port, headers }, (res) => {
    let body = '';
    res.on('data', (c) => { body += c; });
    res.on('end', () => { console.log(body); server.close(); });
  }).end();
});

{"ip":"203.0.113.7","ips":["203.0.113.7"],"protocol":"https","host":"books.example.com"}

import Fastify from 'fastify';

const app = Fastify({ trustProxy: '127.0.0.1' });  // an address or CIDR list; a bare hop count is refused
app.get('/', async (req) => ({ ip: req.ip, ips: req.ips, protocol: req.protocol, host: req.host }));

await app.listen({ port: 0, host: '127.0.0.1' });
const { port } = app.server.address();
const res = await fetch(`http://127.0.0.1:${port}/`, {
  headers: {
    'x-forwarded-for': '1.2.3.4, 203.0.113.7',
    'x-forwarded-proto': 'https',
    'x-forwarded-host': 'books.example.com',
  },
});
console.log(await res.json());
await app.close();

{
  ip: '203.0.113.7',
  ips: [ '127.0.0.1', '203.0.113.7' ],
  protocol: 'https',
  host: 'books.example.com'
}