From 728a039163810b56e1e8ec029def5f233b5116cd Mon Sep 17 00:00:00 2001
From: Ardis Lu <ardisglu@gmail.com>
Date: Tue, 26 May 2026 20:57:38 -0700
Subject: [PATCH] Harden server config to mitigate request exhaustion

---
 src/getPrf.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/getPrf.js b/src/getPrf.js
index 1ad00b6..767629d 100644
--- a/src/getPrf.js
+++ b/src/getPrf.js
@@ -74,6 +74,9 @@ export async function getPrf(options = {}) {
   const scriptHash = new Uint8Array(await crypto.subtle.digest('SHA-512', encoder.encode(script))).toBase64();
 
   const server = http.createServer();
+  server.keepAliveTimeout = 0;
+  server.maxRequestsPerSocket = 1;
+  server.requestTimeout = 1000;
 
   // Flow expires after 2 minutes or canceled
   const timeoutId = setTimeout(() => server.close(() => abortResolve(null)), WINDOW_EXPIRATION_DURATION);
-- 
2.47.3