From 49e84c8176b24cd45d6bfb99f78c7cea4a54f98c Mon Sep 17 00:00:00 2001 From: Arthur Belleville Date: Fri, 15 May 2026 12:50:25 +0200 Subject: [PATCH] fix(05-WR-01): raise ReadTimeout/WriteTimeout to 120s for large uploads 15s was too short for 25MB uploads on slow connections (~256KB/s takes ~100s). Both timeouts are raised to 120s to accommodate MAX_UPLOAD_SIZE_MB at worst-case bandwidth with headroom. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- backend/cmd/web/main.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/backend/cmd/web/main.go b/backend/cmd/web/main.go index 7d164c6..0d003c5 100644 --- a/backend/cmd/web/main.go +++ b/backend/cmd/web/main.go @@ -119,8 +119,14 @@ func main() { Addr: ":" + port, Handler: router, // T-01-10 slow-client mitigation per RESEARCH Security Domain. - ReadTimeout: 15 * time.Second, - WriteTimeout: 15 * time.Second, + // ReadTimeout covers request header + body read; 15 s is sufficient for API + // calls but upload routes read up to MAX_UPLOAD_SIZE_MB (default 25 MB). The + // MaxBytesReader in FileUploadHandler bounds the body size, not time; a slow + // upload at ~256 KB/s takes ~100 s. WriteTimeout covers the full request + // lifecycle from accept to response flush, so it must be generous enough for + // large uploads. 120 s accommodates 25 MB at ~250 KB/s with headroom. + ReadTimeout: 120 * time.Second, + WriteTimeout: 120 * time.Second, IdleTimeout: 60 * time.Second, }