From: Ardis Lu <ardisglu@gmail.com>
Date: Wed, 27 May 2026 03:57:38 +0000 (-0700)
Subject: Harden server config to mitigate request exhaustion
X-Git-Tag: v0.1.3~12
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=728a039163810b56e1e8ec029def5f233b5116cd;p=envpass

Harden server config to mitigate request exhaustion
---

diff --git a/src/getPrf.js b/src/getPrf.js
index 1ad00b6..767629d 100644
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -74,6 +74,9 @@ export async function getPrf(options = {}) {
   const scriptHash = new Uint8Array(await crypto.subtle.digest('SHA-512', encoder.encode(script))).toBase64();
 
   const server = http.createServer();
+  server.keepAliveTimeout = 0;
+  server.maxRequestsPerSocket = 1;
+  server.requestTimeout = 1000;
 
   // Flow expires after 2 minutes or canceled
   const timeoutId = setTimeout(() => server.close(() => abortResolve(null)), WINDOW_EXPIRATION_DURATION);