restify / clients

HttpClient, StringClient, and JsonClient extracted from restify
MIT License
57 stars 34 forks source link

httpclient.close() isn't really safe #164

Open hekike opened 6 years ago

hekike commented 6 years ago

MOVED FROM: https://github.com/restify/node-restify/issues/642

HttpClient.close() reaches into the Node agent and calls end() on all of the sockets in use by the agent. It doesn't check that the socket's remote address matches the server that the client was created with. More importantly, though, the Node documentation says not to touch these sockets, and the problem with doing this is that if you call client.close() and then try to make another request (with a different client or even outside restify, AFAICT), the Node agent may decide to use one of the sockets that has started closing, and it will immediately get a "socket hang up" error.

I don't think there's a great way to implement close() given the current agent API, but what restify's doing right now makes it possible to run into bugs like node-manta#194. If the point of close() is basically for command-line programs to wrap things up, then it should probably be a global function (i.e., not per-agent), since it's closing everything, and it probably needs to be provided by the agent implementation.