aiohttp server lacks an initial request/header timeout

Summary

The keepalive timeout was not used during the initial portion of a request.

Impact

An attacker could keep an idle connection open indefinitely before sending any data.

Workaround

Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.