feat(xo-server): increase HTTP server request timeout to 1 day

Fixes #6590

CHANGELOG.unreleased.md

@@ -11,6 +11,8 @@
 
 > Users must be able to say: “I had this issue, happy to know it's fixed”
 
+- [REST API] Fix 5 minutes timeouts on VDI/VM uploads [#6568](https://github.com/vatesfr/xen-orchestra/issues/6568)
+
 ### Packages to release
 
 > When modifying a package, add it here with its release type.

packages/xo-server/config.toml

@@ -125,6 +125,15 @@ port = 80
 # These options are applied to all listen entries.
 [http.listenOptions]
 
+# Number of milliseconds allowed to receive the entire request.
+#
+# The default value changed from no limit to 5 minutes in Node 18.0 to mitigate
+# Slowloris attacks.
+#
+# This breaks a number of XO use cases, for instance uploading a VDI via the
+# REST API, therefore it's changed to 1 day.
+requestTimeout = 86400000
+
 [http.mounts]
 '/' = '../xo-web/dist'
 

packages/xo-server/package.json

@@ -82,7 +82,7 @@
     "highland": "^2.11.1",
     "http-proxy": "^1.16.2",
     "http-request-plus": "^0.14.0",
-    "http-server-plus": "^0.12.0",
+    "http-server-plus": "^1.0.0",
     "human-format": "^1.0.0",
     "iterable-backoff": "^0.1.0",
     "js-yaml": "^4.1.0",

yarn.lock

@@ -10769,6 +10769,13 @@ http-server-plus@^0.12.0:
   dependencies:
     promise-toolbox "^0.21.0"
 
+http-server-plus@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/http-server-plus/-/http-server-plus-1.0.0.tgz#cb7adc1ca3e679e8728286a6c9b5b1bd012ccbfd"
+  integrity sha512-7+rIueA7QHj7C9OIDD+2S8hdv8wH3V2CJjih00rF/d2CXMuBcUed4tmp1APxNVpjwblz4RHezHFocq7PSiqJ5A==
+  dependencies:
+    promise-toolbox "^0.21.0"
+
 http-signature@~1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/http-signature/-/http-signature-1.2.0.tgz#9aecd925114772f3d95b65a60abb8f7c18fbace1"