🛡️ Sentinel: [HIGH] Fix Slow Read DoS vulnerability (Missing Write Deadline)

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2026-10-06 - Missing Write Deadline Due to Dynamic App Delays
+**Vulnerability:** The HTTP server lacked a write deadline (write timeout) when no artificial response delay was configured. This omission left the application vulnerable to Slow Read Denial of Service (DoS) attacks, where an attacker could slowly read responses and hold server connections open indefinitely.
+**Learning:** `http.Server.WriteTimeout` cannot be used safely if the application intends to hold requests open intentionally (e.g., simulating a 30s delay response or holding a long-poll connection). If `WriteTimeout` is set on the server, it enforces a hard global timeout. Therefore, `WriteTimeout` was omitted, but doing so without alternative dynamic deadlines leaves endpoints unprotected.
+**Prevention:** When building servers that simulate long delays or handle long-polling, standard `http.Server` timeouts may be too restrictive. Instead of removing write deadlines completely, use `http.NewResponseController(w).SetWriteDeadline(...)` per-request to enforce a timeout that accommodates the expected specific response delay (e.g., `time.Now().Add(expectedDelay + 30*time.Second)`).

internal/server/server.go

@@ -117,15 +117,16 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	})
 
 	if s.opts.CORS && isPreflight(r) {
+		_ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(30 * time.Second))
 		resp := events.Response{Status: http.StatusNoContent, Headers: corsHeaders(r, true)}
 		write(w, resp)
 		s.store.Complete(id, resp, time.Since(start))
 		return
 	}
 
 	resp := s.resp.Render()
+	_ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(resp.Delay + 30*time.Second))
 	if resp.Delay > 0 {
-		_ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(resp.Delay + 30*time.Second))
 		timer := time.NewTimer(resp.Delay)
 		defer timer.Stop()
 		select {