limits, timeouts, max content sizes.

relay/handlers.go

@@ -26,6 +26,8 @@ func saveEvent(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	r.Body = http.MaxBytesReader(w, r.Body, 50000)
+
 	w.Header().Set("content-type", "application/json")
 
 	var evt Event
@@ -36,6 +38,12 @@ func saveEvent(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// disallow large contents
+	if len(evt.Content) > 1000 {
+		log.Warn().Err(err).Msg("event content too large")
+		return
+	}
+
 	// check serialization
 	serialized, err := evt.Serialize()
 	if err != nil {

relay/main.go

@@ -50,10 +50,12 @@ func main() {
 	router.Path("/query_users").Methods("GET").HandlerFunc(queryUsers)
 
 	srv := &http.Server{
-		Handler:      cors.Default().Handler(router),
-		Addr:         s.Host + ":" + s.Port,
-		WriteTimeout: 15 * time.Second,
-		ReadTimeout:  15 * time.Second,
+		Handler:           cors.Default().Handler(router),
+		Addr:              s.Host + ":" + s.Port,
+		WriteTimeout:      2 * time.Second,
+		ReadTimeout:       2 * time.Second,
+		IdleTimeout:       30 * time.Second,
+		ReadHeaderTimeout: 2 * time.Second,
 	}
 	log.Debug().Str("addr", srv.Addr).Msg("listening")
 	srv.ListenAndServe()