Update files

Author: marianore-muttdata

docs/pages/reference/configuration/environment-variables.mdx

@@ -1061,6 +1061,30 @@ Until v0.35, the default value was `schema`.
 It can be also set using the [`schema_path` configuration
 option](/reference/configuration/config#schema_path).
 
+## `CUBEJS_SERVER_HEADERS_TIMEOUT`
+
+Limit the amount of time the parser will wait to receive the complete HTTP headers.
+If the timeout expires, the server responds with status 408 without
+forwarding the request to the request listener and then closes the connection.
+
+It must be set to a non-zero value (e.g. 120 seconds) to protect against
+potential Denial-of-Service attacks in case the server is deployed without a
+reverse proxy in front.
+
+| Possible Values                           | Default in Development | Default in Production |
+| ----------------------------------------- | ---------------------- | --------------------- |
+| A valid number or string representing one | 60000                  | 60000                 |
+
+
+## `CUBEJS_SERVER_KEEP_ALIVE_TIMEOUT`
+
+The number of milliseconds of inactivity a server needs to wait for additional incoming data,
+after it has finished writing the last response, before a socket will be destroyed.
+
+| Possible Values                           | Default in Development | Default in Production |
+| ----------------------------------------- | ---------------------- | --------------------- |
+| A valid number or string representing one | 5000                   | 5000                  |
+
 ## `CUBEJS_SQL_USER`
 
 A username required to access the [SQL API][ref-sql-api].

packages/cubejs-backend-shared/src/env.ts

@@ -144,6 +144,12 @@ const variables: Record<string, (...args: any) => any> = {
   webSockets: () => get('CUBEJS_WEB_SOCKETS')
     .default('false')
     .asBoolStrict(),
+  serverHeadersTimeout: () => get('CUBEJS_SERVER_HEADERS_TIMEOUT')
+    .default('60000')
+    .asInt(),
+  serverKeepAliveTimeout: () => get('CUBEJS_SERVER_KEEP_ALIVE_TIMEOUT')
+    .default('5000')
+    .asInt(),
   rollupOnlyMode: () => get('CUBEJS_ROLLUP_ONLY')
     .default('false')
     .asBoolStrict(),

packages/cubejs-server/src/server.ts

@@ -34,6 +34,11 @@ interface HttpOptions {
 
 export interface CreateOptions extends CoreCreateOptions, WebSocketServerOptions, SQLServerOptions {
   webSockets?: boolean;
+  sqlPort?: number;
+  pgSqlPort?: number;
+  gatewayPort?: number;
+  serverKeepAliveTimeout?: number;
+  serverHeadersTimeout?: number;
   http?: HttpOptions;
   gracefulShutdown?: number;
 }
@@ -47,7 +52,7 @@ type RequireOne<T, K extends keyof T> = {
 export class CubejsServer {
   protected readonly core: CubeCore;
 
-  protected readonly config: RequireOne<CreateOptions, 'webSockets' | 'http' | 'sqlPort' | 'pgSqlPort'>;
+  protected readonly config: RequireOne<CreateOptions, 'webSockets' | 'http' | 'sqlPort' | 'pgSqlPort' | 'serverKeepAliveTimeout' | 'serverHeadersTimeout'>;
 
   protected server: GracefulHttpServer | null = null;
 
@@ -64,6 +69,8 @@ export class CubejsServer {
       sqlPort: config.sqlPort || getEnv('sqlPort'),
       pgSqlPort: config.pgSqlPort || getEnv('pgSqlPort'),
       gatewayPort: config.gatewayPort || getEnv('nativeApiGatewayPort'),
+      serverKeepAliveTimeout: config.serverKeepAliveTimeout || getEnv('serverKeepAliveTimeout'),
+      serverHeadersTimeout: config.serverHeadersTimeout || getEnv('serverHeadersTimeout'),
       http: {
         ...config.http,
         cors: {
@@ -103,6 +110,8 @@ export class CubejsServer {
       }
 
       this.server = gracefulHttp(http.createServer(options, app));
+      this.server.keepAliveTimeout = this.config.serverKeepAliveTimeout;
+      this.server.headersTimeout = this.config.serverKeepAliveTimeout;
 
       if (this.config.webSockets) {
         this.socketServer = new WebSocketServer(this.core, this.config);