fix: increase default render timeout to 15s

Covers browser renderer which can take longer than 10s.

Author: harlan-zw

docs/content/3.guides/13.security.md

@@ -43,7 +43,7 @@ For sites that need a mix of static and dynamic images, you can prerender specif
 
 Every request has its `width` and `height` clamped to `maxDimension` (default `2048` pixels). The Takumi renderer's `devicePixelRatio` is capped to `maxDpr` (default `2`).
 
-If a render exceeds `renderTimeout` (default `10000ms`), it is aborted and the server returns a `408` status.
+If a render exceeds `renderTimeout` (default `15000ms`), it is aborted and the server returns a `408` status.
 
 These are all enabled by default. You only need to configure them if you want different limits.
 
@@ -53,7 +53,7 @@ export default defineNuxtConfig({
     security: {
       maxDimension: 2048,
       maxDpr: 2,
-      renderTimeout: 10000,
+      renderTimeout: 15000,
     }
   }
 })

docs/content/4.api/3.config.md

@@ -182,7 +182,7 @@ Security limits for image generation. See the [Security Guide](/docs/og-image/gu
 
 - **`maxDimension`**: Maximum width or height in pixels. Default `2048`.
 - **`maxDpr`**: Maximum device pixel ratio (Takumi renderer). Default `2`.
-- **`renderTimeout`**: Milliseconds before the render is aborted with a `408` response. Default `10000`.
+- **`renderTimeout`**: Milliseconds before the render is aborted with a `408` response. Default `15000`.
 - **`maxQueryParamSize`**: Maximum query string length (in characters) for runtime requests. Returns `400` when exceeded. Default `null` (no limit).
 - **`restrictRuntimeImagesToOrigin`**: Restrict runtime image generation to requests whose `Host` header matches allowed hosts. Default `false`. See the [Security Guide](/docs/og-image/guides/security#restrict-runtime-images-to-origin) for details.
 
@@ -192,7 +192,7 @@ export default defineNuxtConfig({
     security: {
       maxDimension: 2048,
       maxDpr: 2,
-      renderTimeout: 10000,
+      renderTimeout: 15000,
       restrictRuntimeImagesToOrigin: true, // lock to site config URL host
       // or: ['https://cdn.example.com'] // allow additional hosts
     }

src/module.ts

@@ -204,7 +204,7 @@ export interface ModuleOptions {
     maxDimension?: number
     /** Maximum device pixel ratio (takumi renderer). @default 2 */
     maxDpr?: number
-    /** Render timeout in milliseconds. Returns 408 on timeout. @default 10000 */
+    /** Render timeout in milliseconds. Returns 408 on timeout. @default 15000 */
     renderTimeout?: number
     /**
      * Maximum allowed length (in characters) for the query string on runtime OG image requests.
@@ -1412,7 +1412,7 @@ export const rootDir = ${JSON.stringify(nuxt.options.rootDir)}`
         security: {
           maxDimension: config.security?.maxDimension ?? 2048,
           maxDpr: config.security?.maxDpr ?? 2,
-          renderTimeout: config.security?.renderTimeout ?? 10_000,
+          renderTimeout: config.security?.renderTimeout ?? 15_000,
           maxQueryParamSize: config.security?.maxQueryParamSize ?? null,
           restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin === true
             ? []

src/runtime/server/util/eventHandlers.ts

@@ -121,7 +121,7 @@ export async function imageEventHandler(e: H3Event) {
   let image: H3Error | BufferSource | Buffer | Uint8Array | false | void = cacheApi.cachedItem
   if (!image) {
     const { security } = useOgImageRuntimeConfig()
-    const timeout = security?.renderTimeout || 10_000
+    const timeout = security?.renderTimeout || 15_000
     image = await Promise.race([
       renderer.createImage(ctx),
       new Promise<never>((_, reject) =>