This lesson's interactive features are locked, please to keep using them

Timeouts

Requests that take too long will hold connections open and consume server resources, making DoS attacks much more effective. Node has separate timeouts for receiving headers and the request body:

const server = app.listen(3000);
server.headersTimeout = 10_000; // receive complete headers
server.requestTimeout = 30_000; // receive the complete request body

These settings limit how long the client can take to send a request, but they do not cancel a slow route handler. If you have a potentially expensive operation and want to time out your own handler, pass an AbortSignal to the API doing the work:

const signal = AbortSignal.timeout(2_000);

return fetch("https://shipping.example/reservations", {
  method: "POST",
  body: JSON.stringify(order),
  signal, // propagate the timeout
});

After two seconds, the signal aborts and fetch rejects (because fetch is built to support AbortSignal). These kinds of timeouts are useful for database queries, third-party API calls, or any other work that can hang indefinitely.

Assignment

Bearly Secure's simulated Acorn fulfillment reservation can stall checkout indefinitely.

Bound both incoming requests and the fulfillment call.

In src/main.ts, set the headers and requests timeouts.
In src/routes/checkout.ts, import the isAcornFulfillmentTimeout and reserveAcornFulfillmentWithTimeout functions from "../integrations/acornFulfillment.ts".
Try reserveAcornFulfillmentWithTimeout instead of reserveAcornFulfillment using the acornFulfillmentDelayMs dependency setting.
If an error occurs, rethrow it unless isAcornFulfillmentTimeout(error) returns true.
Otherwise, use the sendFulfillmentTimeout function to send the retryable 503 response and stop checkout.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.