HTTP Setup: Default WriteTimeout

[C0x41lch0x41]

What problem does your feature solve?

There is no default WriteTimeout in the setup of http server. If the server instance is used using a configuration without WriteTimeout it will be set to 0 which means no timeout. That may be an issue if a request takes too much time to process and can potentially lead to DoS the server.
We need to be careful how this value is set though. It should be more than ReadTimeout.

Those two articles provide useful information in my opinion:

• So you want to expose Go on the Internet
• The complete guide to Go net/http timeouts

What would you like to see?

A default value for WriteTimeout in HTTP setup function

What alternatives are there?

We already have a default ReadTimeout and Go >= 1.13 sets a pretty aggressive TCP timeout, so this may be sufficient if our services does not let the client control parameters that influence the processing time of a request. But it is good practice in case there is a edge case.

[stellarsaur]

We discussed this, and came to the conclusion we need to take a more careful look at our existing timeouts to make sure we use the right default WriteTimeout. Ideally, this should be longer than all our existing timeouts, but not unlimited like it currently is.

Moved back to our backlog for now.

[leighmcculloch]

Fyi this was something we investigated previously. There are some findings here.