Socketio max message size and max_decode_packets

[aktoak]

I have few questions regarding Flask Socketio

1. Is there a way to set max message size sent using websocket and drop messages that doesn't exceed the max size. to prevent malicious attacks on my server.

2. can you please explain what is the max_decode_packets which is set to default of 16? how does this affect users or server?

3. does Flask Socket io has some protection against Dos attacks? for Example a user who decides to spam the server with infinite websocket connections ( authorization not needed).

Thanks you!

[miguelgrinberg]

1. Flask-SocketIO does not enforce a max packet size for WebSocket currently, it uses whatever defaults are defined by the WebSocket implementation you use. But this should be improved. Older versions of the JS reference implementation of Socket.IO did not have a limit for WebSocket packets, but the current version uses the same constant to limit both HTTP and WebSocket packets. I'll update this.
2. max_decode_packets applies to the polling transport, which allows a single request to carry multiple packets. This collection of packets is called a "payload". This variable limits how many packets can be sent in a single request, to prevent an attacker from sending a large number of little packets, still below the 1MB maximum size, but potentially causing a major disruption to the server.
3. In 2021 it would be very irresponsible to have a public server that does not require authentication. But that said, Flask-SocketIO attaches to Flask's WSGI application as an additional middleware. You can add any other WSGI middlewares of your choosing to protect your server before messages reach the Flask or Flask-SocketIO layers.

Added miguelgrinberg/python-engineio#260 to keep track of the work associated with the first item.

[aktoak]

1. Thats Great, thanks:)

2. Got it.

3. I am authenticating over websockets and i am Using nginx as a WebSocket Reverse Proxy with the default config:

server {
    listen 80;
    server_name _;

    location / {
        include proxy_params;
        proxy_pass http://127.0.0.1:5000;
    }

    location /static {
        alias <path-to-your-application>/static;
        expires 30d;
    }

    location /socket.io {
        include proxy_params;
        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_pass http://127.0.0.1:5000/socket.io;
    }
}

as specified in the Flask-Socketio documentation.

do you think that Nginx limiter for proxied http would work for flask socketio location?
nginx-limiter

i've been looking for answer, but couldn't find any regarding flask socketio.

[miguelgrinberg]

I don't understand how is this related to Flask-SocketIO. Nginx-limiter is for HTTP connections, including the WebSocket connection, which starts as an HTTP upgrade request. If you are expecting to limit websocket packets once the connection has been established then the answer no, the limiter will not look at WebSocket packets.