internal: add default go http server timeouts (#17858)

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

internal/outpost/proxyv2/proxyv2.go

@@ -195,7 +195,7 @@ func (ps *ProxyServer) Stop() error {
 }
 
 func (ps *ProxyServer) serve(listener net.Listener) {
-	srv := &http.Server{Handler: ps.mux}
+	srv := web.Server(ps.mux)
 
 	// See https://golang.org/pkg/net/http/#Server.Shutdown
 	idleConnsClosed := make(chan struct{})

internal/utils/web/server.go

@@ -0,0 +1,17 @@
+package web
+
+import (
+	"net/http"
+	"time"
+)
+
+func Server(h http.Handler) *http.Server {
+	return &http.Server{
+		Handler:           h,
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      60 * time.Second,
+		IdleTimeout:       120 * time.Second,
+		MaxHeaderBytes:    http.DefaultMaxHeaderBytes,
+	}
+}

internal/web/web.go

@@ -241,9 +241,7 @@ func (ws *WebServer) listenPlain() {
 }
 
 func (ws *WebServer) serve(listener net.Listener) {
-	srv := &http.Server{
-		Handler: ws.mainRouter,
-	}
+	srv := web.Server(ws.mainRouter)
 
 	// See https://golang.org/pkg/net/http/#Server.Shutdown
 	idleConnsClosed := make(chan struct{})