Is there a way to restrict message size received for server?

[Frefreak]

I don't know much about websockets. Sorry if this is a noob question. What if a client send a large chunk of data to the server? It seems currently the server would try to parse the message anyways. Is there a way to configure it so that messages are discarded as soon as what the server received has already exceeds a certain limits, say 5MB?

[jaspervdj]

This is currently not supported, but it should not be extremely hard to add. The client must first send the length of the message, so it could be discarded at that point already, without parsing the 5MB of data.

[Frefreak]

Thank you for your answer! Looking forward to this.

[lpeterse]

I'll share my thoughts and insights on this:

• The current API is dangerous IMHO as it does not allow to restrict memory usage when receiving.
• RFC 6455 has a section on it, but doesn't give clear guidance about what to do actually.
• One solution would be to add a size limit (either per connection or per receive call). Open question:
  • What to do if the limit is exceeded? Terminate the connection or return the prefix of the message and skip the remainder? The next be message might be within the limit again and skipping chunk per chunk only requires constant memory.
• Streaming interface as proposed by @snoyberg in issue #60:
  • How shall a safe and fool-proof API look like?
  • Go's implementation uses the concept of a reader per message. Question: What if the next reader is requested before the first message has been streamed completely?
  • How to stream text data? The RFC explicitly states that unicode sequence boundaries might spread over frame boundaries. This is not easy to solve.
  • The streaming interface proposed by @snoyberg alone doesn't solve the problem: Frames itself are nearly unlimited in size. What is needed here is a mechanism to directly consume the chunks of a frame.

[jaspervdj]

I'm in favor of doing the simplest thing that could work in this case, which is allowing people to set a maximum chunk and/or message size. If a message exceeds this limit, an exception is thrown and the connection is closed.

[jaspervdj]

@lpeterse @Frefreak I've created #152 to add these. I still need to add some tests but unless there's significant objections I think that is the API I will go with.

[Frefreak]

I haven't got time to try it but the API looks good to me. Let's wait for some time before closing this issue. Thanks for you work!

update: just tested it manually and it seems to work as expected.