Skip to content

fix(humafiber): don't time out or panic in ServeHTTP - #1152

Merged
robtme merged 2 commits into
danielgtaylor:mainfrom
APX403:fiber-servehttp-no-panic
Oct 27, 2026
Merged

robtme merged 2 commits into
danielgtaylor:mainfrom
APX403:fiber-servehttp-no-panic

Conversation

@APX403

@APX403 APX403 commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

With autopatch on Fiber, a PATCH whose PUT handler takes more than a second brings the server down:

app := fiber.New()
api := humafiber.New(app, huma.DefaultConfig("My API", "1.0.0"))

huma.Get(api, "/things/{id}", getThing)
huma.Put(api, "/things/{id}", func(ctx context.Context, input *struct {
	ID   string `path:"id"`
	Body Thing
}) (*ThingResponse, error) {
	time.Sleep(1200 * time.Millisecond) // a slow write
	return &ThingResponse{Body: &input.Body}, nil
})

autopatch.AutoPatch(api)
log.Fatal(app.Listen(":8888"))

The first PATCH ends the process with panic: i/o timeout (panic: test: timeout error 1000ms with humafiber.NewV2).

autopatch sends its internal GET and PUT through the adapter's ServeHTTP (autopatch.go#L317, #L449). Both Fiber adapters implement it with Fiber's Test, which gives up after one second by default, and panic on any error it returns (humafiber.go#L261-L269, humafiber_v2.go#L263-L271). Fiber doesn't recover panics by default, so the panic stops the server.

ServeHTTP now turns the timeout off (TestConfig{Timeout: 0} on v3, -1 on v2), so it waits for the handler like the net/http adapters do, and answers any other Test error with a 500 instead of panicking. The 500 has a generic body, since the error from Test can quote the raw request.

This is the timeout and the panic left out of #1140.

ServeHTTP runs the request through Fiber's Test, which gives up after one
second by default, and panics on any error it returns. Fiber doesn't
recover panics by default, so a PATCH whose PUT handler took more than a
second stopped a server that uses autopatch. Wait for the handler, and
answer a remaining Test error with a 500.
@codecov

codecov Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.72%. Comparing base (4035252) to head (556d0b8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1152      +/-   ##
==========================================
- Coverage   94.73%   94.72%   -0.01%     
==========================================
  Files          25       25              
  Lines        5200     5193       -7     
==========================================
- Hits         4926     4919       -7     
  Misses        269      269              
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@robtme

robtme commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator

Thanks, this looks good. I checked the Fiber source: Timeout: 0 on v3 and -1 on v2 are the right ways to turn the timeout off (0 on v2 would time out immediately). With the adapter change reverted, the new tests panic with i/o timeout, so they cover the bug.

@robtme
robtme merged commit c67743c into danielgtaylor:main Oct 27, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants