codesnips
go 21 lines · 1 tab

HTTP server timeouts that prevent slowloris and stuck connections

Leah Thompson Jan 2026
1 tab 
package main

import (
  "context"
  "net/http"
  "time"
)

func newServer(handler http.Handler) *http.Server {
  return &http.Server{
    Addr:              ":8080",
    Handler:           handler,
    ReadHeaderTimeout: 2 * time.Second,
    ReadTimeout:       10 * time.Second,
    WriteTimeout:      10 * time.Second,
    IdleTimeout:       60 * time.Second,
    BaseContext: func(net.Listener) context.Context {
      return context.Background()
    },
  }
}
1 file · go Explain with highlit

The default http.Server will happily keep connections open longer than you intended, which is how you end up with “mysterious” goroutine growth during partial outages. I set ReadHeaderTimeout to protect against slowloris-style attacks, keep IdleTimeout tight to reclaim keep-alive sockets, and set ReadTimeout/WriteTimeout as a coarse guardrail for handlers that forget to enforce per-request deadlines with context.WithTimeout. I also use a custom BaseContext so every connection inherits a root context that can be canceled on shutdown. The win is operational: when something goes wrong, connections drain predictably and you don’t end up with thousands of half-open clients pinning memory. This is a small config block, but it’s a big reliability upgrade.

Related snips

go 
package api

import (
  "net/http"
  "runtime/debug"
)

Expose build metadata for debugging deploys

go observability build
by Leah Thompson 1 tab
typescript 
export interface RetryOptions {
  retries: number;
  baseMs: number;
  maxMs: number;
  signal?: AbortSignal;
  onRetry?: (attempt: number, delay: number, err: unknown) => void;

Exponential backoff with jitter for retries

typescript reliability retry
by codesnips 2 tabs
go 
package dbutil

import (
  "context"

  "github.com/jackc/pgconn"

Retry Postgres serialization failures with bounded attempts

go postgres transactions
by Leah Thompson 1 tab
go 
package files

import (
  "context"
  "time"

Presigned S3 upload URLs (AWS SDK v2)

go aws s3
by Leah Thompson 1 tab
go 
package deps

import (
  "net"
  "net/http"
  "time"

HTTP client tuned for production: timeouts, transport, and connection reuse

go http client
by Leah Thompson 1 tab
go 
package api

import (
  "io"
  "net/http"
  "os"

Safe multipart uploads using temp files (bounded memory)

go http uploads
by Leah Thompson 1 tab

Share this code

Here's the card — post it anywhere.

HTTP server timeouts that prevent slowloris and stuck connections — share card
Link copied