Skip to content

Add body size limits and server configurations - #3

Merged
ghosind merged 7 commits into
go-amwk:mainfrom
ghosind:feat/security-improve
Jul 17, 2026
Merged

ghosind merged 7 commits into
go-amwk:mainfrom
ghosind:feat/security-improve

Conversation

@ghosind

@ghosind ghosind commented Jul 17, 2026

Copy link
Copy Markdown
Member

This PR adds request/response body size limits, HTTP server configurations (timeouts, max header size, etc.), and thread-safety improvements.

Key Changes

  • Add request and response body size limits to prevent resource exhaustion attacks.
  • Add HTTP server configurations for timeouts and maximum header size to enhance security and performance.
  • Customize shutdown behavior to ensure graceful termination of the server.
  • Improve request/response behaviors.

Breaking Changes

  • Constructors return*Application instead of the Application interface.
  • Body size limits for request and response.
  • ClientIP method now returns the IP address without port information.

ghosind added 7 commits July 15, 2026 14:39
- Update Default and New to return *Application type.
- Add Address and SetAddress methods to Application.
- Add Application method to Request and Response.

Signed-off-by: Chen Su <ghosind@gmail.com>
Signed-off-by: Chen Su <ghosind@gmail.com>
Signed-off-by: Chen Su <ghosind@gmail.com>
Signed-off-by: Chen Su <ghosind@gmail.com>
- Update max response body size config to atomic.Int64.
- Add configurable shutdown signal listening.
- Setter methods return *Application to support chaining.

Signed-off-by: Chen Su <ghosind@gmail.com>
Signed-off-by: Chen Su <ghosind@gmail.com>
Signed-off-by: Chen Su <ghosind@gmail.com>
@ghosind
ghosind requested a review from Copilot July 17, 2026 03:26
@ghosind ghosind added the enhancement New feature or request label Jul 17, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the HTTP server defaults and adds configurable request/response body size limits, while also adjusting the public construction API to return *Application for direct configuration.

Changes:

  • Introduces request body limiting (http.MaxBytesReader) and response buffering with max-size enforcement.
  • Adds server configuration defaults (timeouts, max header bytes) and exposes option/setter APIs to configure them.
  • Updates documentation and tests to reflect new configuration surface area and breaking API return types.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
response.go Buffers responses and enforces a configurable maximum response body size.
response_test.go Adds/updates unit tests for response body limits and Application association.
request.go Adds request body limiting, query caching/copying, and Application association on requests.
request_test.go Adds/updates unit tests for request body limits, idempotent Body(), and ClientIP formatting.
README.md Documents new configuration options and updates handler signature example.
option.go Expands Option helpers to configure server timeouts, header limits, body limits, and shutdown behavior via setters.
option_test.go Adds test coverage for the expanded option surface.
errors.go Adds ErrResponseTooLarge for response body limit enforcement.
app.go Adds server defaults, body-limit settings, shutdown configuration, and updates constructors to return *Application.
app_unix_test.go Updates tests for constructor return type change.
app_test.go Updates/extends tests for new configuration getters/setters and constructor return type.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread app.go
Comment on lines +175 to +178
// TODO: add error handling
_ = ctx.Next()

_ = resp.send()
@ghosind
ghosind merged commit df185af into go-amwk:main Jul 17, 2026
9 checks passed
@ghosind
ghosind deleted the feat/security-improve branch July 24, 2026 09:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants