Files
OmniRoute/docs/security
diegosouzapw 3ce03abae3 fix(sse): add first-byte watchdog to the TLS-fingerprint transport (#12656)
The wreq-js TLS-fingerprint transport resolved the Response as soon as
upstream headers arrived, with zero guard around how long the caller then
waited for the body's first byte. TlsClient's only timing control, a flat
timeout, defaults to 600_000ms, matching the reported 90-600s stall window
exactly.

Add guardTlsFirstByte() (open-sse/utils/tlsFirstByteWatchdog.ts), which
races the body's first read() against a short, env-overridable watchdog
(TLS_FIRST_BYTE_WATCHDOG_MS, default 10s). A healthy body is unaffected
(bytes already buffered are replayed through a passthrough stream); a
stalled body cancels the wreq reader and throws, letting proxyFetch's
existing TLS-fallback catch blocks fall through to the direct/proxy
dispatcher. A non-replay-safe request (e.g. a POST with a body) still
throws instead of being silently retried, reusing isTlsFallbackReplaySafe.
2026-09-10 15:35:13 -03:00
..
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-05-29 12:44:29 -03:00
2026-07-04 13:00:30 -03:00