http: fix keep-alive not timing out after post-request empty line

[islandryu]

Fixes: #58140

As shown in the test code, sending an empty line after a request can result in a state where the keep-alive timer is reset, but neither requestTimeout nor keepAliveTimeout is active.
Unless a custom timeout is implemented, this allows the client to hold the socket indefinitely.

Modified behavior so that data like an empty line, which does not indicate the start of an HTTP message, no longer resets the keep-alive timeout.

FYI

Here is the behavior of other HTTP servers:

nginx: When client_header_timeout is set, sending an empty line after a request triggers a 408 timeout response once the timeout period expires.

Apache: When RequestReadTimeout header=5-10,MinRate=500 is configured, the connection times out after the specified duration, but no error code is sent.

However, since the timing for resetting the keep-alive timeout is not clearly defined in RFC 9112 or similar specifications, I believe this change is appropriate.

[nodejs-github-bot]

Review requested:

• @nodejs/http
• @nodejs/net

[islandryu]

node/lib/_http_server.js

Lines 1040 to 1041 in c46b2b9

	functionparserOnIncoming(server,socket,state,req,keepAlive){
	resetSocketTimeout(server,socket,state);

The timing for resetting the keep-alive timeout should be limited to this part—specifically, when llhttp determines that parsing is necessary.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.13%. Comparing base (a36981a) to head (350b680).
Report is 460 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #58178 +/- ##
==========================================
- Coverage 90.21% 90.13% -0.09% 
==========================================
Files 630 630 Lines 186391 186782 +391 Branches 36608 36654 +46 ==========================================
+ Hits 168161 168357 +196 - Misses 11052 11203 +151 - Partials 7178 7222 +44 

Files with missing lines	Coverage Δ
lib/_http_server.js	97.06% <ø> (-0.01%)	⬇️

... and 78 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Failed to start CI

 ⚠ No approving reviews found
✘ Refusing to run CI on potentially unsafe PR

https://github.com/nodejs/node/actions/runs/14841662619

[lpinca]

I would create the connection after the server emits the 'listening' event.

[lpinca]

There is no guarantee that all data will be received in a single chunk.

[islandryu]

Thx, fixed test code.

[ShogunPanda]

LGTM!

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/66735/

[mcollina]

Lgtm

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/66736/

[nodejs-github-bot]

Commit Queue failed

- Loading data for nodejs/node/pull/58178
✔ Done loading data for nodejs/node/pull/58178
----------------------------------- PR info ------------------------------------
Title http: fix keep-alive not timing out after post-request empty line (#58178)
⚠ Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch islandryu:fix/httpEmptyLine -> nodejs:main
Labels http, author ready, needs-ci
Commits 2
- http: fix keep-alive not timing out after post-request empty line
- fix test
Committers 1
- islandryu <shimaryuhei@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/58178
Fixes: https://github.com/nodejs/node/issues/58140
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/58178
Fixes: https://github.com/nodejs/node/issues/58140
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
--------------------------------------------------------------------------------
ℹ This PR was created on Mon, 05 May 2025 08:46:23 GMT
✔ Approvals: 2
✔ - Paolo Insogna (@ShogunPanda) (TSC): https://github.com/nodejs/node/pull/58178#pullrequestreview-2829062997
✔ - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/58178#pullrequestreview-2829334728
✘ Last GitHub CI failed
ℹ Last Full PR CI on 2025-05-09T18:21:27Z: https://ci.nodejs.org/job/node-test-pull-request/66736/
- Querying data for job/node-test-pull-request/66736/
✔ Last Jenkins CI successful
--------------------------------------------------------------------------------
✔ Aborted `git node land` session in /home/runner/work/node/node/.ncu

https://github.com/nodejs/node/actions/runs/14936022305

[ShogunPanda]

@islandryu Can you please fix failing test so we can move this forward?

[islandryu]

@ShogunPanda
Sorry, I should have mentioned you, but I’ve already made the fix here.
#58324

Separately, I used to be able to view the Jenkins results until recently, but now I’m getting a permission error and can no longer access them.
Do you know what might be causing this?

[lpinca]

CI is under security embargo.

[ShogunPanda]

No worries, let's wait for the other PR to land and then you can rebase this.

About your question, maybe @nodejs/build-infra has some idea?

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/67586/

[nodejs-github-bot]

Landed in 057b4b5

[janakj]

Thank you very much for fixing this!

[joyeecheung]

This has been flaking the CI for over a month #59577