GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Fixed http_server timeout logic for requestTimeout and headerTimeout by emilfihlman · Pull Request #43354 · nodejs/node

Conversation

@emilfihlman

@emilfihlman emilfihlman commented Jun 9, 2022 •
edited by aduh95
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

According to the documentation and also logic, headersTimeout should be smaller or equal to requestTimeout. This fixes the logic handling this check.

Node could also clamp requestTimeout to headersTimeout if the latter is larger, but that's a design decision for a different
person.

I suspect there might be other range issues like this, too.

Fixes: #43355

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bricss reacted with eyes emoji
All reactions
  • 👀 1 reaction
@emilfihlman
Fixed http_server timeout logic for requestTimeout and headerTimeout
9efa532
According to the documentation and also logic, headersTimeout should be smaller or equal to requestTimeout. This fixes the logic handling this check.

Node could also clamp requestTimeout to headersTimeout if the latter is larger, but that's a design decision for a different person.

I suspect there might be other range issues like this, too.
@nodejs-github-bot

nodejs-github-bot commented Jun 9, 2022

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/http
  • @nodejs/net
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nodejs-github-bot nodejs-github-bot added http Issues and PRs related to the http subsystem. needs-ci PRs that need a full CI run. labels Jun 9, 2022
@emilfihlman emilfihlman mentioned this pull request Jun 9, 2022
http_server handles headersTimeout and requestTimeout checking wrong #43355
Closed
aduh95
aduh95 reviewed Jun 9, 2022
View reviewed changes
Comment thread lib/_http_server.js

if (this.requestTimeout > 0 && this.headersTimeout > 0 && this.headersTimeout >= this.requestTimeout) {
throw new codes.ERR_OUT_OF_RANGE('headersTimeout', '>= requestTimeout', headersTimeout);
if (this.requestTimeout > 0 && this.headersTimeout > 0 && this.headersTimeout > this.requestTimeout) {

@aduh95 aduh95 Jun 9, 2022

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the reasoning for changing this check? Before this PR, it was not accepted to have headersTimeout equals to requestTimeout. You mentioned the docs in the OP, but I don't seem to find that; could you link to where you've read that?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@emilfihlman emilfihlman Jun 9, 2022

Copy link
Copy Markdown
Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aduh95 a request can be complete when the headers have been finished. Looking at the code and the docs for headersTimeout and requestTimeout, it's imho clear that the intention is/was that headersTimeout<=requestTimeout. Additionally people like to be able to set their arguments logically, so requiring that requestTimeout needs to be 1001 if you want headersTimeout to be 1000 is silly.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@aduh95 aduh95 Jun 9, 2022

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As I said in my previous comment, I wasn't able to find that in the docs. When referring to the docs, it'd be helpful to quote the exact docs so we know we're talking of the same thing (or even better use the permalink feature of GitHub). (and if it is not in the docs, that's also fine, but in this case you shouldn't say "According to the documentation and also logic", but rather "According to me": that'd still be a valid reason to make that change and reviewers wouldn't waste time reading the docs looking for something that's not there 😉)

Since it is a behavior change, we should add an history entry to the YAML comment. That would look something like this (but with a different pr-url & description of course):

node/doc/api/http.md

Lines 1401 to 1405 in 3caa2c1

changes:
- version: REPLACEME
pr-url: https://github.com/nodejs/node/pull/41263
description: The default request timeout changed
from no timeout to 300s (5 minutes).

it's imho clear that the intention is/was that headersTimeout<=requestTimeout

Let's not assume intent, I don't think that's relevant, and it's easy to get wrong.

requiring that requestTimeout needs to be 1001 if you want headersTimeout to be 1000 is silly.

I agree that does seem to be an unnecessary requirement – unless I'm missing something? @ShogunPanda when you said it's redundant, do you mean that users should just remove headersTimeout if it's set to the same value as requestTimeout?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@emilfihlman emilfihlman Jun 9, 2022

Copy link
Copy Markdown
Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apologies, I was arrogant. I appreciate you being kind to me.

Yes, the docs don't cleanly say that it must be x. I take it as implied, since the docs say:

For headersTimeout
"Limit the amount of time the parser will wait to receive the complete HTTP headers."

For requestTimeout
"Sets the timeout value in milliseconds for receiving the entire request from the client."

and a complete entire request can be just the http headers.

but implication is also easy to get wrong.

I wish it was so, that we could cleanly set headersTimeout as <= of requestTimeout. It allows explicitly defining what happens, and would, in my opinion, be logical.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@ShogunPanda

ShogunPanda commented Jun 9, 2022

Copy link
Copy Markdown
Contributor

I agree with @aduh95. The check on line 394 is correct and needs no fix. Having headersTimeout equals to requestTimeout is redundant.

The fix on line 395 (the error thrown) is instead as the message is wrong (my bad :()

@emilfihlman By documentation do you mean the message thrown?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@emilfihlman

emilfihlman commented Jun 9, 2022 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Author

E: I apologise for the tone on this comment.

@ShogunPanda if it's as intended then the intention should be changed. A request can be complete when the headers arrive, thus it's silly to require that requestTimeout needs to be say 1001 if you want headersTimeout to be 1000.

Imho the code clearly shows that the intention was that headersTimeout<=requestTimeout, and it should be that way.

I'd very much like to hear a justified reason as to why headersTimeout couldn't be requestTimeout and why it needs to be smaller and not selectable to be the same.

Additionally, not allowing headersTimeout to be requestTimeout would result in inability to limit requestHandling to 1ms, always requiring it to be 2ms at minimum. Sure, it's a small edge case, but I can definitely see it happening at some point, and we shouldn't prevent people from making small timeouts if they so wish.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@aduh95

aduh95 commented Jun 10, 2022

Copy link
Copy Markdown
Contributor

@ShogunPanda it does seem a sub-optimal API design that setting requestTimeout to a value lower than 60000 forces the user to also set a value for headersTimeout (which can't be the same). Should we change headersTimeout default value to be Math.min(60_000, requestTimeout)?

emilfihlman reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@ShogunPanda

ShogunPanda commented Jun 10, 2022

Copy link
Copy Markdown
Contributor

First of all, headersTimeout can definitely be equal as requestTimeout. It's harmless as the connections checking interval will anyway detect connection as expired. Just to clarify, now that requestTimeout exists and works properly regardless of the presence of the body, headersTimeout is not needed most of the times.

Anyway, @emilfihlman I suggest to do the following on this PR:

  1. Allow headersTimeout === requestTimeout
  2. Set default value of headersTimeout as Math.min(60_000, requestTimeout) as @aduh95 suggested and fix the relevant documentation
  3. Fix the typo in the error message.

Are you willing to perform the changes this in PR?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@emilfihlman

emilfihlman commented Jun 10, 2022

Copy link
Copy Markdown
Author

@ShogunPanda sure!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@ShogunPanda
ShogunPanda self-requested a review June 14, 2022 10:09
@Trott
Trott force-pushed the main branch from 2d76238 to ca3ed36 Compare November 12, 2022 01:49
@ShogunPanda

ShogunPanda commented Nov 21, 2022

Copy link
Copy Markdown
Contributor

@emilfihlman Are you willing to update this or shall we close this PR and continue on our own?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@ShogunPanda ShogunPanda mentioned this pull request Dec 7, 2022
http: Improved timeout defaults handling. #45778
Merged
@ShogunPanda

ShogunPanda commented Dec 7, 2022

Copy link
Copy Markdown
Contributor

This has been superseded by #44163 and #45778.
Closing.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@ShogunPanda ShogunPanda closed this Dec 7, 2022
@coderabbitai coderabbitai Bot mentioned this pull request Jul 26, 2026
Make Render health checks immediate and deterministic AlexAyvazian/Map#19
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aduh95 aduh95 aduh95 left review comments
@ShogunPanda ShogunPanda Awaiting requested review from ShogunPanda

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

http Issues and PRs related to the http subsystem. needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

http_server handles headersTimeout and requestTimeout checking wrong

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@emilfihlman @nodejs-github-bot @ShogunPanda @aduh95
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.