No way to set timeout for the entire request, which allows DoS attacks about ureq HOT 4 CLOSED

Yes. This would be a really nice feature. I'm not entirely sure how one would implement it though. It's like the timeouts in TCP connection/read/write must be adjusted dynamically from some start time, and then top it off with closing the connection if it goes on too long.

from ureq.

You could compute a request deadline (or let the user explicitly specify it, there is an opinion that deadlines are the better API) and then set the read timeout to min(read_timeout, time_until_request_deadline) every once in a while. Doing so on every read is probably wasteful, but doing no more frequently than once in e.g. 250 milliseconds should be precise enough and have a small enough performance hit.

from ureq.

A simple implementation of a timeout for the entire request can be viewed here: neonmoe/minreq@41ef16e
However, if used as-is it may have a significant performance penalty.

from ureq.

Here's another way of accomplishing this: sbstp/attohttpc#47

from ureq.