Secure WebSockets: Stopping Denial of Service

TL;DR

WebSockets are great for real-time apps, but they’re vulnerable to DoS attacks because a single connection can tie up server resources. This guide shows you simple steps to protect your WebSocket servers from being overwhelmed.

Protecting Your WebSockets From Denial of Service

Understand the Threat

WebSockets maintain persistent connections, unlike typical HTTP requests.
An attacker can open many connections to exhaust server resources (CPU, memory, bandwidth).
DoS attacks don’t necessarily need sophisticated tools; simple scripts can cause problems.

Rate Limiting

Limit the number of connections from a single IP address within a specific timeframe.

Implement this at your load balancer or reverse proxy (e.g., Nginx, HAProxy).
Example using iptables (Linux):
sudo iptables -A INPUT -p tcp –syn –dport 8080 -m recent –name websocket_limit –set –rsync –count 10 –seconds 60 -j DROP
This example limits connections to port 8080 to 10 per minute from each IP. Adjust the port and values as needed.

Connection Limits

Set a maximum number of total concurrent WebSocket connections your server can handle.

Your application code should enforce this limit.
If the limit is reached, reject new connection attempts with an appropriate error message (e.g., 1013 – Going Away).
Example in Node.js using a simple counter:
let maxConnections = 500;
wss.on(‘connection’, ws => {
if (activeConnections >= maxConnections) {
ws.send(1013, ‘Server is currently overloaded’);
ws.close();
return;
}
activeConnections++;
// … rest of your connection handling code …
});

Authentication and Authorisation

Only allow authenticated users to establish WebSocket connections.

Implement a secure authentication mechanism (e.g., JWT tokens).
Verify the user’s identity before allowing access to specific WebSocket endpoints or data streams.
This prevents attackers from opening connections without legitimate credentials.

Message Size Limits

Restrict the maximum size of messages sent over WebSockets.

Large messages can consume significant server resources and potentially lead to DoS.
Implement checks in your application code to reject oversized messages.
Example (pseudocode):
if (messageSize > maxSize) {
ws.send(‘Message too large’);
ws.close();
}

Input Validation

Validate all data received over WebSockets to prevent malicious payloads.

Sanitise input to avoid code injection or other vulnerabilities.
Use a schema validation library if possible.

Keep-Alive Checks (Heartbeats)

Regularly check the health of WebSocket connections.

Implement ping/pong messages to detect dead or unresponsive clients.
Close inactive or unhealthy connections to free up server resources.
Most WebSocket libraries have built-in support for heartbeats.

Monitor Your Server

Track key metrics like connection count, CPU usage, and memory consumption.

Use monitoring tools to detect unusual activity that might indicate a DoS attack.
Set up alerts to notify you of potential problems.

The post Secure WebSockets: Stopping Denial of Service appeared first on Blog | G5 Cyber Security.