fix(server): set ReadHeaderTimeout and IdleTimeout on all HTTP servers

[whoAbhishekSah]

Fixes #1819.

All three http.Server instances in pkg/server/server.go (connect, metrics, UI) were built with only Addr and Handler. Nothing limited how long a client could withhold request headers or keep an idle connection open.

• The idle_timeout default exceeds common proxy keep-alive timeouts (ALB 60s, nginx 75s). Deployments behind a proxy with a longer keep-alive should raise it, so the proxy never sends a request on a connection the server is already closing.
• No WriteTimeout on purpose: the connect server streams long export responses (e.g. ExportAuditRecords) that a write deadline would cut off.
• No ReadTimeout either; it would need a value that accounts for large request bodies, and the header timeout already covers the slow-client case this issue is about.

Testing

• go build ./pkg/server/... and go test ./pkg/server/ pass.
• Verified with a throwaway config test that Load fills both defaults (10s / 180s) when the fields are absent from the config file.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 12, 2026 4:08am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ed42436-963f-4a00-a26b-57a0c8b16fc4

📥 Commits

Reviewing files that changed from the base of the PR and between 562e230 and ea86b58.

📒 Files selected for processing (3)

• config/sample.config.yaml
• pkg/server/config.go
• pkg/server/server.go

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added configurable connection timeouts for application endpoints.
  • Added a 10-second request-header timeout and a 180-second idle keep-alive timeout by default.
  • Included configuration guidance to support proxy compatibility.
  • Preserved streaming response support for Connect endpoints.

Walkthrough

The change adds ReadHeaderTimeout and IdleTimeout settings with defaults of 10 seconds and 180 seconds. The UI, Connect, and metrics HTTP servers apply both settings. The Connect server keeps WriteTimeout unset for streaming responses.

Changes

HTTP server timeouts

Layer / File(s)	Summary
Timeout configuration config/sample.config.yaml, pkg/server/config.go	The configuration defines documented request-header and idle keep-alive timeouts with 10s and 180s defaults.
HTTP server timeout wiring pkg/server/server.go	The UI, Connect, and metrics servers apply both configured timeouts. The Connect server does not set a write timeout for streaming responses.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: amangit07, rohilsurana

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes configure ReadHeaderTimeout and IdleTimeout on connect, metrics, and UI servers with suitable defaults and preserve streaming behavior by omitting WriteTimeout and ReadTimeout.
Out of Scope Changes check	✅ Passed	All changes support issue #1819 by adding, documenting, and applying the requested HTTP server timeout settings.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 31562278057

Coverage increased (+0.006%) to 48.103%

Details

• Coverage increased (+0.006%) from the base build.
• Patch coverage: 4 uncovered changes across 1 file (11 of 15 lines covered, 73.33%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
pkg/server/server.go	15	11	73.33%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	39927
Covered Lines:	19206
Line Coverage:	48.1%
Coverage Strength:	15.37 hits per line

---

💛 - Coveralls

[whoAbhishekSah]

Tested this live. Built the branch and ran server (connect 18002, metrics 19000, UI 18100) against the same local DB. Probed with raw TCP clients that stall mid-request or sit idle on a keep-alive connection.

Test	Config	Expected	Got
Slow client never finishes headers	defaults	dropped at 10s	closed at 10.0s on all 3 servers
Slow client never finishes headers	read_header_timeout: 3s	dropped at 3s	closed at 3.0s on all 3 servers
Idle keep-alive connection	idle_timeout: 6s	closed at 6s	closed at 6.0s
Reuse connection after 2s idle	idle_timeout: 6s	second request works	worked
Reuse connection after 12s idle	defaults (180s)	connection survives	worked — idle timeout is not tied to the 10s header timeout
Normal RPC through connect	both configs	server answers	answered fine (401 without a cookie, as expected)

Defaults fill in when the config file has no timeout keys, and setting read_header_timeout / idle_timeout under app: changes the behavior on all three servers.