First byte timeout
We have in hyper a HTTP1 header read timeout (which is strangely not available for HTTP?) and this works great... if the client sends at least one byte (or a newline?).
If the client never sends a single byte, and just holds the connection open, the timeout never triggers.
I suggest we either make the timeout trigger even when no bytes have been sent (make the timer start ticking the minute serve_connection() is called) or we introduce another field explicitly for first byte timeout.
This will harden hyper servers against clients who attempt to open and hog connections open without any intention of sending any data.
Yes, several have indicated that a separate timeout makes sense: https://github.com/hyperium/hyper/pull/3185#issuecomment-1728216663