pub const FETCH_TIMEOUT: Duration;Expand description
How long the whole client metadata fetch may take — connect, headers and body together, not just the handshake.
client_id is chosen by an unauthenticated caller, so the host on the
other end of this GET is one an attacker picks. A connect_timeout alone
would not bound a server that completes its handshake and then trickles
the body forever; this is the total deadline, applied per request so it
holds whichever [reqwest::Client] a deployment wires in.
Ten seconds because that is what crate::relay::REQUEST_TIMEOUT — the
only other outbound HTTP deadline this crate sets — already uses, and it
sits comfortably inside crate::routes::REQUEST_TIMEOUT’s thirty seconds
for the inbound request this fetch happens underneath.