[SECURITY-ISSUE]: Spamming the Websocket makes the friends api respons with 500 server error on client side

FabCodeDE commented 2 months ago

Contact Details

itsmefab

What happened?

Stress testing the websocket with around 500 connections at the same time brings down the websocket i guess. Dont want to do more testing. Maybe sort out the connection on server side that dont contain valid data, and also add an authentication to the websocket including the connection or something to block something like that.

Where is this happening?

Backend

What platform are you seeing the problem on?

Not a launcher related problem

Version (for launcher bugs)

No response

Relevant log output

No response

onlyJakob commented 2 months ago

~~afaik the client don't use websockets and~~ authentication doesn't protect against a DOS attack.

Edit: the launcher doesn't use websockets, idk about the client

copyandexecute commented 2 months ago

Hi, hast du lust mir auf Discord zu schreiben was du gemachst hast? Ich wäre dir sehr dankbar, mach einfach ein Ticket auf

FabCodeDE commented 2 months ago

Hi, hab schon ein Ticket im Discord aufgemacht

FabCodeDE commented 2 months ago

https://discord.com/channels/774271756549619722/1280164524783304744

copyandexecute commented 3 weeks ago

Cloudflare ratelimit eingebaut + websocket internal ratelimit

NoRiskClient / issues