No server-level request timeout / slow-loris protection

[Darkdruce]

Summary

There is no per-request timeout layer; a slow client can hold a connection/handler open.

Location

• src/api/mod.rs:46-93 (layers: cors/trace/body-limit/rate-limit, no timeout)

Details & impact

Slow-loris-style clients can tie up server resources, especially combined with the unbounded limiter map.

Suggested fix

Add tower_http::timeout::TimeoutLayer (and consider header/read timeouts at the server).

Acceptance criteria

• Requests exceeding a configured timeout are aborted.

[Markodiba6399]

Hi, I'd like to work on this issue.
This is a real gap. Without a timeout layer, a slow or malicious client can hold a connection open indefinitely, and combined with the unbounded limiter map mentioned in the codebase, that's a meaningful resource exhaustion risk (essentially a slow-loris vector) rather than just a theoretical concern.
My proposed approach:
Add tower_http::timeout::TimeoutLayer to the layer stack in src/api/mod.rs:46-93, positioned appropriately relative to the existing cors/trace/body-limit/rate-limit layers so it aborts requests before they can hold resources through the full stack.
Make the timeout duration configurable (env var or config struct, matching however other tunables like rate limits are already configured in this project), with a sensible default.
Verify the timeout produces a clean error response (e.g., 408 Request Timeout) rather than a raw connection drop, so clients get a diagnosable failure.
Look at whether server level read/header timeouts are also needed (e.g., at the hyper/tokio listener level) to cover cases where a client is slow to send headers in the first place, since TimeoutLayer alone only bounds handler execution time after the request is accepted.
Add a test that simulates a slow handler/client and confirms the request is aborted at the configured threshold.

[grantfox-oss]

🦊 GrantFox — @Markodiba6399 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #131)
2. Your PR will be reviewed by the StellarGateLabs maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@Markodiba6399's PR #183 was approved and merged by @Manuel1234477.

🏆 @Markodiba6399: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (624 total points). Track your full progress on GrantFox.

👏 Great work, @Markodiba6399! Keep contributing to StellarGateLabs.