This lesson's interactive features are locked, please to keep using them

Timeouts

Requests that take too long hold connections open and consume server resources, making DoS attacks much more effective. Go's http.Server exposes separate timeouts for each phase of a connection:

server := &http.Server{
    Addr:              ":3030",
    Handler:           handler,
    ReadHeaderTimeout: 10 * time.Second,
    ReadTimeout:       30 * time.Second,
    WriteTimeout:      30 * time.Second,
    IdleTimeout:       120 * time.Second,
}

ReadHeaderTimeout and ReadTimeout stop slow clients from tying up a connection while sending a request. WriteTimeout bounds response writes, and IdleTimeout closes keep-alive connections that sit unused.

Server timeouts don't cancel a slow operation inside a handler. For that, derive a deadline from the request's context.Context and pass it into the work:

timeoutContext, cancel := context.WithTimeout(request.Context(), 2 * time.Second)
defer cancel()

reservation, err := reserve(timeoutContext, order)

If reserve is still running after two seconds, the deadline expires, timeoutContext.Done() closes, and timeoutContext.Err() returns context.DeadlineExceeded. Creating a deadline can't stop code that ignores it. The operation must receive from the context's Done channel and return the error.

These timeouts are useful for database queries, third-party API calls, and anything else that can hang indefinitely.

Assignment

Bearly Secure's simulated Acorn fulfillment reservation can stall checkout indefinitely.

Bound both incoming requests and the fulfillment call.

In the httpserver.NewServer constructor in internal/httpserver/server.go, configure the Bearly Secure http.Server with finite timeouts:
- 10 seconds to read request headers.
- 30 seconds to read a request.
- 30 seconds to write a response.
- 120 seconds for an idle keep-alive connection.
In internal/checkout/handler.go, call the provided acorn.ReserveWithTimeout function instead of acorn.Reserve.
When fulfillment returns context.DeadlineExceeded, stop checkout and return 503 Service Unavailable with:
- Retry-After: 1
- The existing checkout error page with Shipping is temporarily unavailable. Try again shortly.
Keep handling every other fulfillment error with the existing internal-error response.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.