RHOBS-1683: set ReadHeaderTimeout on HTTP server

[tremes]

Add a 10s ReadHeaderTimeout to prevent Slowloris-style connection exhaustion. Matches the default used by openshift-mcp-server.

Assisted-by: Claude Code:claude-opus-4-6

[openshift-ci-robot]

@tremes: This pull request references RHOBS-1683 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Add a 10s ReadHeaderTimeout to prevent Slowloris-style connection exhaustion. Matches the default used by openshift-mcp-server.

Assisted-by: Claude Code:claude-opus-4-6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f415e118-afcb-47cd-bfb4-2fd1600e3976

📥 Commits

Reviewing files that changed from the base of the PR and between 9e7e8e6 and 3810312.

📒 Files selected for processing (2)

• pkg/mcp/server.go
• pkg/mcp/server_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Security

  • Sensitive request headers, including authorization and cookie values, are now redacted from logs.
  • Non-sensitive headers remain available for troubleshooting.

• Bug Fixes

  • Improved HTTP server resilience with a 10-second timeout while reading request headers.
  • Helps prevent connections from waiting indefinitely during incomplete or slow requests.

• Tests

  • Added coverage for sensitive-header redaction, header preservation, empty headers, and timeout configuration.

Walkthrough

Request logging now redacts Authorization, Proxy-Authorization, and Cookie header values. NewHTTPServer now sets ReadHeaderTimeout to 10 seconds. Tests cover header redaction and timeout configuration.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 38103

The server now limits request-header reads to 10 seconds to reduce Slowloris-style connection exhaustion; no actionable merge-blocking risk remains.

Suggested reviewers: inecas, slashpai

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the primary change: setting ReadHeaderTimeout on the HTTP server.
Description check	✅ Passed	The description directly explains the 10-second ReadHeaderTimeout and its purpose of preventing Slowloris-style connection exhaustion.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: iNecas, tremes

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [iNecas,tremes]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment