Websocket Security

const WebSocket = require('ws');
const jwt = require('jsonwebtoken');

const ALLOWED_ORIGINS = [
  'https://app.example.com',
  'https://admin.example.com',
];

const server = new WebSocket.Server({ 
  port: 8080,
  verifyClient: (info, callback) => {
    // Origin validation
    const origin = info.origin || info.req.headers.origin;
    if (origin && !ALLOWED_ORIGINS.includes(origin)) {
      console.warn(`Rejected connection from origin: ${origin}`);
      callback(false, 403, 'Forbidden origin');
      return;
    }

    // Token validation from query string or headers
    const token = info.req.url.split('token=')[1] 
      || info.req.headers.authorization?.replace('Bearer ', '');

    if (!token) {
      callback(false, 401, 'Authentication required');
      return;
    }

    try {
      const decoded = jwt.verify(token, process.env.JWT_SECRET);
      info.req.user = decoded;
      callback(true);
    } catch (error) {
      callback(false, 401, 'Invalid token');
    }
  },
});

server.on('connection', (ws, req) => {
  const user = req.user;
  console.log(`Authenticated user ${user.id} connected`);
  
  // Set connection timeout for idle connections
  ws._idleTimeout = setTimeout(() => {
    ws.close(4000, 'Connection timeout');
  }, 300000);

  ws.on('message', () => {
    // Reset idle timeout on activity
    clearTimeout(ws._idleTimeout);
    ws._idleTimeout = setTimeout(() => {
      ws.close(4000, 'Connection timeout');
    }, 300000);
  });
});

const WebSocket = require('ws');

class RateLimiter {
  constructor(options = {}) {
    this.maxMessages = options.maxMessages || 100;
    this.windowMs = options.windowMs || 60000;
    this.connections = new Map();
  }

  check(ws) {
    const now = Date.now();
    const clientData = this.connections.get(ws) || {
      messages: [],
      lastWarning: 0,
    };

    // Clean old messages outside window
    clientData.messages = clientData.messages.filter(
      time => now - time < this.windowMs
    );

    if (clientData.messages.length >= this.maxMessages) {
      return { allowed: false, retryAfter: this.windowMs };
    }

    clientData.messages.push(now);
    this.connections.set(ws, clientData);
    return { allowed: true };
  }

  remove(ws) {
    this.connections.delete(ws);
  }
}

const rateLimiter = new RateLimiter({ maxMessages: 60, windowMs: 60000 });
const messageSizeLimiter = new RateLimiter({ maxMessages: 1048576 }); // 1MB per minute

const server = new WebSocket.Server({ port: 8080 });

server.on('connection', (ws) => {
  ws.on('message', (data) => {
    // Rate limit check
    const rateCheck = rateLimiter.check(ws);
    if (!rateCheck.allowed) {
      ws.close(4002, 'Rate limit exceeded');
      return;
    }

    // Message size validation
    if (data.length > 65536) { // 64KB max
      ws.close(1009, 'Message too large');
      return;
    }

    // Message depth validation (prevent deep nesting attacks)
    try {
      const parsed = JSON.parse(data);
      if (getDepth(parsed) > 10) {
        ws.close(1003, 'Message nesting too deep');
        return;
      }
    } catch {
      ws.close(1007, 'Invalid payload');
    }
  });

  ws.on('close', () => {
    rateLimiter.remove(ws);
    messageSizeLimiter.remove(ws);
  });
});

function getDepth(obj, depth = 0) {
  if (depth > 20) return depth;
  if (obj && typeof obj === 'object') {
    return Math.max(0, ...Object.values(obj).map(
      v => getDepth(v, depth + 1)
    ));
  }
  return depth;
}

const WebSocket = require('ws');
const createDOMPurify = require('dompurify');
const { JSDOM } = require('jsdom');

const window = new JSDOM('').window;
const DOMPurify = createDOMPurify(window);

const server = new WebSocket.Server({ port: 8080 });

server.on('connection', (ws) => {
  ws.on('message', (data) => {
    try {
      const message = JSON.parse(data);

      // Sanitize string fields
      if (message.text) {
        message.text = DOMPurify.sanitize(message.text, {
          ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
          ALLOWED_ATTR: ['href'],
        });

        // Length limit after sanitization
        if (message.text.length > 5000) {
          message.text = message.text.substring(0, 5000);
        }
      }

      // Validate user ID matches authenticated user
      if (message.userId && message.userId !== ws.authenticatedUser.id) {
        ws.send(JSON.stringify({
          type: 'error',
          code: 'FORBIDDEN',
          message: 'Cannot impersonate another user',
        }));
        return;
      }

      // Rate limit per channel
      const channel = message.channel || 'global';
      if (isChannelRateLimited(ws, channel)) {
        return;
      }

      // Broadcast sanitized message
      broadcast(message, ws);
    } catch (error) {
      ws.send(JSON.stringify({
        type: 'error',
        code: 'INVALID_MESSAGE',
        message: 'Invalid message format',
      }));
    }
  });
});

function broadcast(message, sender) {
  server.clients.forEach((client) => {
    if (client.readyState === WebSocket.OPEN) {
      // Do not send to sender
      if (client === sender && message.noEcho) return;

      // Check if client has permission for this channel
      if (!client.subscribedChannels?.has(message.channel)) return;

      client.send(JSON.stringify({
        ...message,
        sanitized: true,
        timestamp: Date.now(),
      }));
    }
  });
}