fix: mitigate slow JSON stream / slow-body attacks

[fzipi]

Summary

• Add nginx client_body_timeout (previously unset), configurable via a new CLIENT_BODY_TIMEOUT env var (default 10s)
• Make Apache's existing RequestReadTimeout MinRate settings configurable via new env vars (REQUEST_READ_TIMEOUT_HEADER, REQUEST_READ_TIMEOUT_HEADER_MIN_RATE, REQUEST_READ_TIMEOUT_BODY, REQUEST_READ_TIMEOUT_BODY_MIN_RATE) instead of hardcoded values, matching this repo's env-var driven configuration convention
• Document the new variables in README.md

Reference: https://github.com/cr0hn/slowjson#mitigations-quick-reference

Test plan

• Build apache and nginx images and confirm they start with the new env vars applied
• Confirm client_body_timeout appears in the rendered nginx config
• Confirm RequestReadTimeout reflects the configured env vars in the rendered Apache config

AI Disclosure

• AI tools used: Claude (Claude Code)
• What was generated/assisted: Identified the missing/hardcoded mitigations from the referenced advisory, drafted the config/Dockerfile/README changes
• Review performed: Verified the Apache ${VAR} substitution mechanism against existing directives in the same config file, verified env var naming/placement against existing conventions in both Dockerfiles, and cross-checked all changed files for internal consistency (grep across templates, Dockerfiles, and README)

Summary by CodeRabbit

• New Features

  • Added new timeout settings for Apache and Nginx containers, giving more control over request body and header handling.
  • Introduced a configurable client body timeout for Nginx.

• Documentation

  • Updated the README to include the new timeout environment variables and their default values.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 11f198d2-e040-4dbd-ab70-f66089bde61f

📥 Commits

Reviewing files that changed from the base of the PR and between 9cde0c2 and 1608542.

📒 Files selected for processing (7)

• README.md
• apache/Dockerfile
• apache/Dockerfile-alpine
• apache/conf/extra/httpd-modsecurity.conf
• nginx/Dockerfile
• nginx/Dockerfile-alpine
• nginx/templates/nginx.conf.template

---

📝 Walkthrough

Walkthrough

This PR introduces configurable request timeout environment variables. Apache and Apache-alpine Dockerfiles add four REQUEST_READ_TIMEOUT_* variables consumed by httpd-modsecurity.conf, replacing hardcoded values. Nginx and Nginx-alpine Dockerfiles add CLIENT_BODY_TIMEOUT, consumed by nginx.conf.template. README documents both.

Changes

Timeout configuration

Layer / File(s)	Summary
Apache request read timeout env vars and config wiring apache/Dockerfile, apache/Dockerfile-alpine, apache/conf/extra/httpd-modsecurity.conf	Four REQUEST_READ_TIMEOUT_* env vars are added and used in the RequestReadTimeout directive, replacing hardcoded header/body timeout and min-rate values.
Nginx client body timeout env var and template wiring nginx/Dockerfile, nginx/Dockerfile-alpine, nginx/templates/nginx.conf.template	CLIENT_BODY_TIMEOUT=10s is added to both Dockerfiles and used in a new client_body_timeout directive in the nginx template.
README documentation of new environment variables README.md	Apache and Nginx ENV variable tables are updated with the new timeout settings, defaults, and reference links.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding timeout-based mitigations for slow-body/slow JSON stream attacks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/slow-json-stream-mitigations

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}