mirror of
https://github.com/gogrlx/nats-server.git
synced 2026-04-15 10:40:41 -07:00
When TLS and authorization is enabled, the authorization timeout can fire during the TLS handshake, causing the server to write the authorization timeout error string into the client socket, injecting what becomes bad data into the TLS handshake. This creates misleading errors on the client such as tls: oversized record received with length 21024. This moves the authorization timeout scheduling to after the TLS handshake to avoid the race. This should be safe since TLS has its own handshake timeout. Added a unit test that fails with the old behavior and passes with the new. LMK if you can think of a better way to test this. Fixes #432