Fix GO-S2114 security issue

See https://deepsource.io/directory/analyzers/go/issues/GO-S2114

consts/consts.go

@@ -41,6 +41,8 @@ const (
 	RequestThrottleBacklogLimit   = 100
 	RequestThrottleBacklogTimeout = time.Minute
 
+	ServerReadHeaderTimeout = 3 * time.Second
+
 	ArtistInfoTimeToLive = 24 * time.Hour
 
 	I18nFolder   = "i18n"

server/server.go

@@ -45,7 +45,12 @@ var startTime = time.Now()
 func (s *Server) Run(addr string) error {
 	s.MountRouter("WebUI", consts.URLPathUI, s.frontendAssetsHandler())
 	log.Info("Navidrome server is ready!", "address", addr, "startupTime", time.Since(startTime))
-	return http.ListenAndServe(addr, s.router)
+	server := &http.Server{
+		Addr:              addr,
+		ReadHeaderTimeout: consts.ServerReadHeaderTimeout,
+	}
+
+	return server.ListenAndServe()
 }
 
 func (s *Server) initRoutes() {