net/http: server may open an unlimited number of file descriptors without program control

[andrewhodel]

https://cs.opensource.google/go/go/+/refs/tags/go1.19.3:src/net/http/server.go;l=2451

The processing code writes a response to the http socket before exposing the request and path to a closure available by the http module.

This allows anyone to open an extreme number of file descriptors on a linux system and other operating systems that use that construct (tcp stack) for handling timeouts without being able to log it.

[andrewhodel]

This locks the http server often.

[ianlancetaylor]

CC @neild

[seankhliao]

If you need to limit the number of connections to accept, the right place to do it is at the net.Listener level, which you can then pass to net/http.Server.Serve
For example https://pkg.go.dev/github.com/aubermardegan/limitedlistener