httpx

func AcquireDeadPeerTimeout ¶ added in v2.6.0

func AcquireDeadPeerTimeout(ctx context.Context, timeout time.Duration) (func(), error)

AcquireDeadPeerTimeout bounds how long data written to the request's connection may stay unacknowledged before the kernel tears it down, and returns a release function restoring the system default once every caller sharing the connection has released it.

Long-lived streams need this because they write on their own schedule into a connection the client may have silently abandoned: left to the defaults the kernel retransmits until tcp_retries2 is exhausted, roughly eleven minutes. TCP keepalive does not cover the case, since probes only fire while a connection is idle and a stream with an unacknowledged write in flight never is.

It is deliberately scoped to one connection rather than the listener: the same listener carries edge tunnel gRPC streams, which tolerate up to edge.TunnelStaleTimeout of silence and would be reset by a shared timeout.

The release function is always safe to call, including when acquisition failed or the request never passed through WithConn.

func DefaultLookupIP ¶

func DefaultLookupIP(ctx context.Context, host string) ([]net.IP, error)

func GetClientBaseURL ¶

func GetClientBaseURL(origin, forwardedHost, forwardedProto, host, appURL string) string

GetClientBaseURL determines the client's base URL from request headers. It checks Origin, X-Forwarded-Host/Proto, and Host headers. If none provide a valid URL, it falls back to the configured appURL.

func GetIntQueryParam ¶

func GetIntQueryParam(r *http.Request, name string, required bool) (int, error)

GetIntQueryParam reads and parses an integer query parameter from the request URL. If `required` is true and the parameter is missing, or if parsing fails, an error is returned.

func GetQueryParam ¶

func GetQueryParam(r *http.Request, name string, required bool) (string, error)

GetQueryParam reads a string query parameter from the request URL. If `required` is true and the parameter is missing or empty, an error is returned.

func NewHTTPClient ¶

func NewHTTPClient() *http.Client

func NewHTTPClientWithTimeout ¶

func NewHTTPClientWithTimeout(timeout time.Duration) *http.Client

func NewSafeOutboundHTTPClient ¶

func NewSafeOutboundHTTPClient(base *http.Client, lookupIP LookupIPFunc) (*http.Client, error)

func SetJSONStreamHeaders ¶

func SetJSONStreamHeaders(headers HeaderSetter)

func ValidateOutboundHTTPURL ¶

func ValidateOutboundHTTPURL(rawURL string) (*url.URL, error)

ValidateOutboundHTTPURL parses and validates an outbound HTTP(S) target URL. It intentionally performs syntactic hardening (scheme/host/credentials) without restricting private network ranges, because environment agents may be deployed on trusted private subnets.

func ValidateSafeRemoteURL ¶

func ValidateSafeRemoteURL(ctx context.Context, rawURL string, lookupIP LookupIPFunc) (*url.URL, error)

func ValidateWebSocketOrigin ¶

func ValidateWebSocketOrigin(appURL string) func(r *http.Request) bool

ValidateWebSocketOrigin validates the Origin header for WebSocket connections to prevent CSRF attacks. It checks: 1. Same-origin requests (Origin matches Host) 2. Allowed origins from appURL 3. Handles empty Origin headers (some clients don't send it)

func WithConn ¶ added in v2.6.0

func WithConn(ctx context.Context, conn net.Conn) context.Context

WithConn stores an accepted connection on its base context. Wire it up as http.Server.ConnContext so long-lived handlers can tune socket options for their own connection without affecting every other client.