Per-request timeout override and cancellation token dependency in Insomnia workspaces

Per‑request timeout precedence

When a request is sent, Insomnia evaluates timeout values in this order:

1. Per‑request timeout (if explicitly set on the request).
2. Workspace‑level timeout (if the per‑request value is omitted).
3. Built‑in default of 60 seconds (if neither the request nor the workspace defines a timeout).

If the underlying request pipeline does not expose a cancellation token (e.g., a plain XMLHttpRequest or a custom adapter without abort support), Insomnia still attempts to enforce the timeout by delegating to the adapter's own timeout mechanism. If that adapter also lacks timeout capability, the per‑request value is ignored and the request runs until the OS or network layer closes the connection.

Client‑side connection teardown vs. OS‑level cleanup

Desktop (Electron) client

Insomnia uses the Node.js http/request library's timeout option. When the timer expires, the library calls req.destroy(), which aborts the socket and triggers an ETIMEDOUT error. The socket is then closed locally; any remaining resources are reclaimed by the Node event loop.

Web client

Insomnia wraps the Fetch API with an AbortController. A per‑request timeout creates a setTimeout that invokes abort() on the controller. This causes the fetch promise to reject with a DOMException named 'AbortError', which Insomnia maps to a timeout error. The browser's networking stack then performs the usual TCP teardown (FIN/ACK) and releases the socket.

In both variants the teardown is initiated by Insomnia; the OS or browser subsequently performs the low‑level socket cleanup. If a proxy or middlebox maintains connection pooling, the socket may remain open on the proxy side until its own idle timeout expires.

Timeout error code and retryable flag consistency

Desktop client: error code ETIMEDOUT, retryable flag false. Web client: error mapped to a generic TimeoutError with retryable flag false. Thus the error semantics (non‑retryable timeout) are consistent across desktop and web variants, regardless of whether the underlying pipeline supplied a cancellation token.