Rate limiter socket

[mathysth]

Hey i'm using hono rate limiter with redis and it work perfectly for me except for socket.
So I was wondering does this library support socket rate limiter ?
I have attached my socket to the server with the following but I can spam the route as I want without any restriction:

this.server.hono.get(
      '/ws',
      upgradeWebSocket(() => {
        return {
          onMessage: async (event, ws) => {
            const response = await this.triggerEvent(event.data);
            if (response || response === false) {
              ws.send(JSON.stringify(response));
            }
          },
        }
      })
    )

[MathurAditya724]

Can you share a reproduction of this? Which runtime are you using?

So, I believe what is happening here is that hono-rate-limiter limits the requests coming from a user through REST API. But in the case of WebSockets, a request occurs only once and the subsequent requests are happening through the WebSocket protocol, which currently hono-rate-limiter is not keeping track of. It limits the number of connections a single user can open in an interval, as that is happening through the REST API.

We can add a helper function, which will run inside the onMessage function or wrap around the createEvent function. So every time a request using the WebSocket protocol comes through, we can track it and limit it based on the value from the keyGenerator. we can call it socketLimiter 😂

What do you think? We will need to figure out the API but the implementation seems easy

[mathysth]

@MathurAditya724 I just implemented the socket limiter but in my opinion, when the client has exceeded the limit he gets disconnected, can we return a code or message so we can handle it from the front ?
Are we forced to disconnect the user can't we do the same as the basic limiter ?

[MathurAditya724]

Hey, the API for the basic rate limiter and the WebSocket one are the same. So, you can use the handler function to customize the behavior.

[mathysth]

Yes I also saw that you let us handle the behavior of the onClose so I will do a custom implementation, thanks you.
For me it's good was a pleasure to help you

[MathurAditya724]

Thank you! I will try to merge this soon (have to finish those tests). Do let me know if you have any more ideas.

[mathysth]

Yes I will create another discussion or issue if I have any idea in the future cause I plan on using it for my project

[alexgleason]

This looks good. I also want to limit the number of concurrent connections to the socket by a user. So for example user a cannot have more than 5 active connections to the socket at once.

[alexgleason]

I already decided this is wrong. Having a connection open is basically free, it's the messages that are the problem.

[alexgleason]

I have a problem where someone is opening 40 websocket connections on my server and then piping /dev/urandom into them, and this destroys my server. I am not completely sure how that translates to individual websocket messages. It seems like both the rate and the size would matter.

[MathurAditya724]

You can use the rateLimiter and websocketLimiter together to limit the number of connections from a user and messages/operations from the socket respectively.

[alexgleason]

Thanks, that's exactly what I plan to do.

I may need to do more than that to mitigate this particular attack. Apparently websocket frames can be 16MB+ in size? I need to test locally to see exactly what happens on the Deno side when you pipe megabytes of trash into the socket.

Thank you for this library. It was very easy to get it going! https://gitlab.com/soapbox-pub/ditto/-/merge_requests/390

[MathurAditya724]

Interesting! you also have a custom function in the websocketLimiter to limit the messages. If you check the size of the messages in that function other than the limiting stuff, you should be good to go!