From 0753cc7465b91068c2941a828539426aabcb3e6f Mon Sep 17 00:00:00 2001 From: AdaAibaby <8872412+adababys@users.noreply.github.com> Date: Thu, 22 Oct 2026 14:23:26 +0800 Subject: [PATCH] fix(api): remove ReadTimeout to prevent premature body-read failures under high concurrency ReadTimeout (10s) is measured from TCP accept, so it includes time the serve goroutine spends queued in the Go scheduler before it runs. Under high concurrency that queue time alone can exceed 10s, so the deadline fires before io.ReadAll ever executes - surfacing as i/o timeout body-read errors that look like client disconnects or auth failures. The intended per-request ceiling is the RequestTimeout middleware (cfg.RequestTimeout, the context deadline), which ReadTimeout preempts and so is never reached. Remove ReadTimeout and the now-unused maxReadTimeout const. ReadHeaderTimeout (5s) is kept for slowloris protection: once headers arrive there is no meaningful slow-body surface, since request bodies on this API are small JSON payloads sent in a single TCP segment. WriteTimeout (75s, asserted > cfg.RequestTimeout at compile time) is unchanged. Rebased onto current main at the maintainers invitation on #3416. Closes #3415. --- packages/api/main.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/packages/api/main.go b/packages/api/main.go index e745d8eed5..ffd789dfde 100644 --- a/packages/api/main.go +++ b/packages/api/main.go @@ -61,7 +61,6 @@ const ( maxUploadLimit = 1 << 24 // 16 MiB maxReadHeaderTimeout = 5 * time.Second - maxReadTimeout = 10 * time.Second // maxWriteTimeout must exceed cfg.RequestTimeout so the request context // cancels before the server's write deadline kills the connection. maxWriteTimeout = 75 * time.Second @@ -251,7 +250,6 @@ func NewGinServer(ctx context.Context, config cfg.Config, tel *telemetry.Client, // Configure request timeouts. ReadHeaderTimeout: maxReadHeaderTimeout, - ReadTimeout: maxReadTimeout, WriteTimeout: maxWriteTimeout, // Configure timeouts to be greater than the proxy timeouts.