Fix #651: Potential Netty memory leak when calling callbacks

wultra · Aug 10, 2023 · 62718da · 62718da
1 parent f7105d3
commit 62718da
Show file tree

Hide file tree

Showing 4 changed files with 36 additions and 9 deletions.
diff --git a/docs/Configuration-Properties.md b/docs/Configuration-Properties.md
@@ -40,13 +40,16 @@ The PowerAuth Server uses the following public configuration properties:
 
 ## HTTP Configuration
 
-| Property | Default | Note |
-|---|---|---|
-| `powerauth.service.http.proxy.enabled` | `false` | Whether proxy is enabled for outgoing HTTP requests |
-| `powerauth.service.http.proxy.host` | `127.0.0.1` | Proxy host for outgoing HTTP requests |
-| `powerauth.service.http.proxy.port` | `8080` | Proxy port for outgoing HTTP requests |
-| `powerauth.service.http.proxy.username` | `_emtpy_` | Proxy username for outgoing HTTP requests |
-| `powerauth.service.http.proxy.password` | `_empty_` | Proxy password for outgoing HTTP requests |
+| Property                                          | Default     | Note                                                |
+|---------------------------------------------------|-------------|-----------------------------------------------------|
+| `powerauth.service.http.proxy.enabled`            | `false`     | Whether proxy is enabled for outgoing HTTP requests |
+| `powerauth.service.http.proxy.host`               | `127.0.0.1` | Proxy host for outgoing HTTP requests               |
+| `powerauth.service.http.proxy.port`               | `8080`      | Proxy port for outgoing HTTP requests               |
+| `powerauth.service.http.proxy.username`           | `_emtpy_`   | Proxy username for outgoing HTTP requests           |
+| `powerauth.service.http.proxy.password`           | `_empty_`   | Proxy password for outgoing HTTP requests           |
+| `powerauth.service.http.connection.timeout`       | `5s`        | HTTP connection timeout                             |
+| `powerauth.service.http.response.timeout`         | `60s`       | HTTP response timeout                               |
+| `powerauth.service.http.connection.max-idle-time` | `200s`      | HTTP max idle time                                  |
 
 ## Spring Vault Configuration
 

diff --git a/...io/getlime/security/powerauth/app/server/configuration/PowerAuthServiceConfiguration.java b/...io/getlime/security/powerauth/app/server/configuration/PowerAuthServiceConfiguration.java
@@ -25,6 +25,8 @@
 import jakarta.annotation.PostConstruct;
 import jakarta.validation.constraints.Max;
 import jakarta.validation.constraints.Min;
+import lombok.Getter;
+import lombok.Setter;
 import org.hibernate.validator.constraints.time.DurationMin;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.context.properties.ConfigurationProperties;
@@ -45,6 +47,8 @@
 @Configuration
 @ConfigurationProperties("ext")
 @Validated
+@Getter
+@Setter
 public class PowerAuthServiceConfiguration {
 
     /**
@@ -208,6 +212,18 @@ public class PowerAuthServiceConfiguration {
     @Value("${powerauth.service.http.connection.timeout}")
     private Duration httpConnectionTimeout;
 
+    /**
+     * HTTP response timeout.
+     */
+    @Value("${powerauth.service.http.response.timeout}")
+    private Duration httpResponseTimeout;
+
+    /**
+     * HTTP connection max idle time.
+     */
+    @Value("${powerauth.service.http.connection.max-idle-time}")
+    private Duration httpMaxIdleTime;
+
     /**
      * Specifies the validity duration of token timestamps, checked before token validation.
      * <p>

diff --git a/.../io/getlime/security/powerauth/app/server/service/behavior/tasks/CallbackUrlBehavior.java b/.../io/getlime/security/powerauth/app/server/service/behavior/tasks/CallbackUrlBehavior.java
@@ -433,6 +433,12 @@ private RestClient initializeRestClient(CallbackUrlEntity callbackUrlEntity) thr
         if (configuration.getHttpConnectionTimeout() != null) {
             builder.connectionTimeout(configuration.getHttpConnectionTimeout());
         }
+        if (configuration.getHttpResponseTimeout() != null) {
+            builder.responseTimeout(configuration.getHttpResponseTimeout());
+        }
+        if (configuration.getHttpMaxIdleTime() != null) {
+            builder.maxIdleTime(configuration.getHttpMaxIdleTime());
+        }
         if (configuration.getHttpProxyEnabled()) {
             final DefaultRestClient.ProxyBuilder proxyBuilder = builder.proxy().host(configuration.getHttpProxyHost()).port(configuration.getHttpProxyPort());
             if (configuration.getHttpProxyUsername() != null) {

diff --git a/powerauth-java-server/src/main/resources/application.properties b/powerauth-java-server/src/main/resources/application.properties
@@ -64,8 +64,10 @@ powerauth.service.http.proxy.port=8080
 powerauth.service.http.proxy.username=
 powerauth.service.http.proxy.password=
 
-# HTTP Connection Timeout in ISO-8601 duration format PTnHnMn.nS
-powerauth.service.http.connection.timeout=PT5S
+# HTTP Connection Configuration
+powerauth.service.http.connection.timeout=5s
+powerauth.service.http.response.timeout=60s
+powerauth.service.http.connection.max-idle-time=200s
 
 # Token Timestamp Validity in ISO-8601 duration format PTnHnMn.nS
 powerauth.service.token.timestamp.validity=PT2H