Fix Unrestricted Resource Consumption in Chi
Unrestricted resource consumption in Chi-based Go services is a prime target for DoS. By failing to enforce request body limits and connection timeouts, you're inviting attackers to exhaust memory via massive payloads or hang goroutines indefinitely using slow-loris tactics. Hardening requires wrapping the transport and the handler logic.
The Vulnerable Pattern
func main() {
r := chi.NewRouter()
r.Post("/data", func(w http.ResponseWriter, r *http.Request) {
// VULNERABLE: io.ReadAll will buffer the entire body into memory regardless of size
body, _ := io.ReadAll(r.Body)
w.Write([]byte("Processed"))
})
// VULNERABLE: Default ListenAndServe has no timeouts
http.ListenAndServe(":8080", r)
}The Secure Implementation
The fix targets three vectors: 1. Memory Exhaustion: `http.MaxBytesReader` restricts the stream size, causing `io.ReadAll` to fail if the limit is exceeded. 2. Handler Stalling: `middleware.Timeout` uses context cancellation to kill handlers that exceed processing windows. 3. Connection Saturation: Configuring `ReadTimeout` and `WriteTimeout` on the `http.Server` struct prevents attackers from keeping connections open indefinitely with slow data trickles. Never rely on Go's default `http.ListenAndServe` in production as it lacks these safeguards.
func main() { r := chi.NewRouter() // Apply global timeout middleware to prevent hanging goroutines r.Use(middleware.Timeout(30 * time.Second))r.Post("/data", func(w http.ResponseWriter, r *http.Request) { // SECURE: Limit request body to 1MB r.Body = http.MaxBytesReader(w, r.Body, 1048576) body, err := io.ReadAll(r.Body) if err != nil { http.Error(w, "Request entity too large", http.StatusRequestEntityTooLarge) return } w.Write([]byte("Processed safely")) }) srv := &http.Server{ Addr: ":8080", Handler: r, ReadTimeout: 5 * time.Second, // SECURE: Max time to read request headers/body WriteTimeout: 10 * time.Second, // SECURE: Max time to write response IdleTimeout: 120 * time.Second, } srv.ListenAndServe()
}
Your Chi API
might be exposed to Unrestricted Resource Consumption
74% of Chi apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.