HttpServer: Make read timeout configurable but disabled by default (#31575)

Co-authored-by: achatterjee-grafana <70489351+achatterjee-grafana@users.noreply.github.com>

conf/defaults.ini

@@ -69,6 +69,10 @@ socket = /tmp/grafana.sock
 # CDN Url
 cdn_url =
 
+# Sets the maximum time in minutes before timing out read of an incoming request and closing idle connections. 
+# `0` means there is no timeout for reading the request.
+read_timeout = 0
+
 #################################### Database ############################
 [database]
 # You can configure the database connection by specifying type, host, name, user and password

conf/sample.ini

@@ -70,6 +70,10 @@
 # CDN Url
 ;cdn_url =
 
+# Sets the maximum time using a duration format (5s/5m/5ms) before timing out read of an incoming request and closing idle connections.
+# `0` means there is no timeout for reading the request.
+;read_timeout = 0
+
 #################################### Database ####################################
 [database]
 # You can configure the database connection by specifying type, host, name, user and password

docs/sources/administration/configuration.md

@@ -268,6 +268,11 @@ Specify a full HTTP URL address to the root of your Grafana CDN assets. Grafana
 For example, given a cdn url like `https://cdn.myserver.com` grafana will try to load a javascript file from
 `http://cdn.myserver.com/grafana-oss/7.4.0/public/build/app.<hash>.js`.
 
+### read_timeout
+
+Sets the maximum time using a duration format (5s/5m/5ms) before timing out read of an incoming request and closing idle connections.
+`0` means there is no timeout for reading the request.
+
 <hr />
 
 ## [database]

docs/sources/whatsnew/whats-new-in-v7-5.md

@@ -148,3 +148,13 @@ For more information on Grafana Enterprise licensing and restrictions, refer to
 ## Breaking changes
 
 There are no known breaking changes in this release.
+
+## Updated configuration
+
+```
+[server]
+read_timeout = 0
+```
+
+Sets the maximum time using a duration format (5s/5m/5ms) before timing out read of an incoming request and closing idle connections.
+`0` means there is no timeout for reading the request.

pkg/api/http_server.go

@@ -115,8 +115,9 @@ func (hs *HTTPServer) Run(ctx context.Context) error {
 	// Remove any square brackets enclosing IPv6 addresses, a format we support for backwards compatibility
 	host := strings.TrimSuffix(strings.TrimPrefix(hs.Cfg.HTTPAddr, "["), "]")
 	hs.httpSrv = &http.Server{
-		Addr:    net.JoinHostPort(host, hs.Cfg.HTTPPort),
-		Handler: hs.macaron,
+		Addr:        net.JoinHostPort(host, hs.Cfg.HTTPPort),
+		Handler:     hs.macaron,
+		ReadTimeout: hs.Cfg.ReadTimeout,
 	}
 	switch hs.Cfg.Protocol {
 	case setting.HTTP2Scheme:

pkg/setting/setting.go

@@ -202,6 +202,7 @@ type Cfg struct {
 	RouterLogging    bool
 	Domain           string
 	CDNRootURL       *url.URL
+	ReadTimeout      time.Duration
 	EnableGzip       bool
 	EnforceDomain    bool
 
@@ -1368,6 +1369,8 @@ func (cfg *Cfg) readServerSettings(iniFile *ini.File) error {
 		}
 	}
 
+	cfg.ReadTimeout = server.Key("read_timeout").MustDuration(0)
+
 	return nil
 }