Security

// guarded-server.mjs - a hardened Chatterbox endpoint on the ws library
import { createServer } from "node:http";
import { WebSocketServer } from "ws";

const ALLOWED_ORIGINS = new Set((process.env.ORIGINS ?? "https://chat.example.test").split(","));
const MAX_FRAME = 16384;          // Chatterbox maxFrameBytes
const MAX_PER_IP = 4;             // concurrent sockets per client address
const RATE = 20, BURST = 40;      // envelopes per second, bucket size
const MAX_BUFFERED = 1 << 20;     // slow-consumer threshold: 1 MiB queued for one socket

const perIp = new Map();
const server = createServer((req, res) => { res.writeHead(404).end(); });
const wss = new WebSocketServer({
  noServer: true,
  maxPayload: MAX_FRAME,          // larger frames close the socket with 1009
  perMessageDeflate: false,       // no compression context to attack, no per-socket zlib memory
  handleProtocols: (protocols) => (protocols.has("chatterbox.v1") ? "chatterbox.v1" : false),
});

function reject(socket, status, text) {
  socket.write(`HTTP/1.1 ${status} ${text}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
  socket.destroy();
}

server.on("upgrade", (req, socket, head) => {
  const origin = req.headers.origin;
  // Browsers always send Origin; other clients may omit it and must authenticate in the first frame.
  if (origin !== undefined && !ALLOWED_ORIGINS.has(origin)) return reject(socket, 403, "Forbidden");
  const ip = req.socket.remoteAddress ?? "unknown";
  if ((perIp.get(ip) ?? 0) >= MAX_PER_IP) return reject(socket, 429, "Too Many Requests");
  wss.handleUpgrade(req, socket, head, (ws) => {
    perIp.set(ip, (perIp.get(ip) ?? 0) + 1);
    ws.on("close", () => perIp.set(ip, perIp.get(ip) - 1));
    ws.on("error", () => ws.terminate()); // ws emits 'error' for a 1009 frame; without a listener the process crashes
    wss.emit("connection", ws, req);
  });
});

wss.on("connection", (ws) => {
  let tokens = BURST, last = Date.now(), strikes = 0;
  ws.on("message", (data, isBinary) => {
    if (isBinary) return ws.close(4400, "text frames only");
    const now = Date.now();
    tokens = Math.min(BURST, tokens + ((now - last) / 1000) * RATE);
    last = now;
    if (tokens < 1) {
      ws.send(JSON.stringify({ v: 1, type: "error", payload: { code: "rate_limited", retryable: true } }));
      if (++strikes >= 5) ws.close(4429, "rate limited");
      return;
    }
    tokens -= 1;
    let env;
    try { env = JSON.parse(data.toString("utf8")); } catch { return ws.close(4400, "bad json"); }
    if (env?.v !== 1 || typeof env.type !== "string") return ws.close(4400, "bad envelope");
    if (ws.bufferedAmount > MAX_BUFFERED) return ws.close(1013, "slow consumer");
    ws.send(JSON.stringify({ v: 1, type: "ack", payload: { ref: env.id, ok: true } }));
  });
});

server.listen(Number(process.env.PORT ?? 18200), "127.0.0.1", () => console.log("listening"));

// probe.mjs - exercises each guard from outside
import WebSocket from "ws";
const URL = "ws://127.0.0.1:18200/ws";
const open = (origin, extra = {}) => new Promise((resolve) => {
  const ws = new WebSocket(URL, "chatterbox.v1", { headers: origin ? { Origin: origin } : {}, ...extra });
  ws.on("open", () => resolve({ ws, ok: true }));
  ws.on("unexpected-response", (_q, res) => resolve({ ok: false, status: res.statusCode }));
  ws.on("error", () => {});
});
const closed = (ws) => new Promise((r) => ws.on("close", (code, reason) => r({ code, reason: reason.toString() })));

let r = await open("https://chat.example.test"); console.log("allowed origin  ->", r.ok ? "101 open" : r.status); r.ws.close();
r = await open("https://evil.example"); console.log("foreign origin  ->", r.ok ? "101 open" : r.status);
r = await open(null); console.log("no Origin       ->", r.ok ? "101 open" : r.status); r.ws.close();

r = await open("https://chat.example.test");
const c = closed(r.ws);
r.ws.send("x".repeat(16385));
console.log("16385-byte frame ->", await c);

const socks = [];
for (let i = 0; i < 6; i++) { const o = await open("https://chat.example.test"); socks.push(o); }
console.log("6 sockets from one IP ->", socks.map((s) => (s.ok ? "open" : s.status)).join(","));
socks.forEach((s) => s.ws?.close());

r = await open("https://chat.example.test");
const c2 = closed(r.ws); let errors = 0;
r.ws.on("message", (d) => { if (JSON.parse(d).type === "error") errors++; });
for (let i = 0; i < 200; i++) r.ws.send(JSON.stringify({ v: 1, type: "presence", id: String(i), payload: {} }));
console.log("200-envelope burst ->", await c2, "rate_limited errors:", errors);
process.exit(0);

allowed origin  -> 101 open
foreign origin  -> 403
no Origin       -> 101 open
16385-byte frame -> { code: 1009, reason: '' }
6 sockets from one IP -> open,open,open,open,429,429
200-envelope burst -> { code: 4429, reason: 'rate limited' } rate_limited errors: 5

import { createServer } from "node:http";
import { Server } from "socket.io";

const allowed = new Set(["https://chat.example.test"]);
const httpServer = createServer();
const io = new Server(httpServer, {
  cors: { origin: [...allowed], credentials: true },   // headers for the polling requests only
  maxHttpBufferSize: 16384,                            // default is 1e6
  perMessageDeflate: false,
  allowRequest: (req, callback) => {                   // runs for polling requests and for the upgrade
    const origin = req.headers.origin;
    callback(null, origin === undefined || allowed.has(origin));
  },
});
io.on("connection", (socket) => socket.on("ping-me", (ack) => ack?.("pong")));
httpServer.listen(Number(process.env.PORT ?? 18201), "127.0.0.1", () => console.log("listening"));

import { io } from "socket.io-client";
const url = "http://127.0.0.1:18201";
const attempt = (origin) => new Promise((resolve) => {
  const s = io(url, { transports: ["websocket"], extraHeaders: { Origin: origin }, reconnection: false });
  s.on("connect", () => { s.disconnect(); resolve("connected"); });
  s.on("connect_error", (e) => { s.disconnect(); resolve("refused: " + e.message); });
});
console.log("allowed origin ->", await attempt("https://chat.example.test"));
console.log("evil origin    ->", await attempt("https://evil.example"));
const big = io(url, { transports: ["websocket"], extraHeaders: { Origin: "https://chat.example.test" }, reconnection: false });
big.on("connect", () => big.emit("ping-me", "x".repeat(20000)));
big.on("disconnect", (reason) => { console.log("20000-char event -> disconnect:", reason); process.exit(0); });

allowed origin -> connected
evil origin    -> refused: websocket error
20000-char event -> disconnect: transport close

import asyncio
import django
from django.conf import settings

settings.configure(ALLOWED_HOSTS=["chat.example.test"], DEBUG=False)
django.setup()

from channels.generic.websocket import AsyncWebsocketConsumer
from channels.security.websocket import AllowedHostsOriginValidator, OriginValidator
from channels.testing import WebsocketCommunicator


class Echo(AsyncWebsocketConsumer):
    async def connect(self):
        await self.accept()


stock = OriginValidator(Echo.as_asgi(), ["https://chat.example.test"])
hosts = AllowedHostsOriginValidator(Echo.as_asgi())


async def try_origin(app, origin):
    headers = [(b"origin", origin.encode())] if origin else []
    comm = WebsocketCommunicator(app, "/ws", headers=headers)
    connected, code = await comm.connect()
    await comm.disconnect() if connected else None
    return "accepted" if connected else f"refused ({code})"


async def main():
    for origin in ("https://chat.example.test", "https://evil.example", None):
        print(f"OriginValidator        {origin!s:28} -> {await try_origin(stock, origin)}")
    for origin in ("https://chat.example.test", "https://evil.example"):
        print(f"AllowedHostsValidator  {origin!s:28} -> {await try_origin(hosts, origin)}")

asyncio.run(main())

OriginValidator        https://chat.example.test    -> accepted
OriginValidator        https://evil.example         -> refused (1000)
OriginValidator        None                         -> refused (1000)
AllowedHostsValidator  https://chat.example.test    -> accepted
AllowedHostsValidator  https://evil.example         -> refused (1000)

// SignalR: CORS covers /chathub/negotiate, AllowedOrigins covers the WebSocket handshake
app.UseWebSockets(new WebSocketOptions { AllowedOrigins = { "https://chat.example.test" } });

// config/reverb.php, apps.apps[0]
'allowed_origins' => ['chat.example.test'],   // the default is ['*']
'max_message_size' => 10_000,                 // bytes, enforced on every client message

listening-port=3478
min-port=18250
max-port=18299
use-auth-secret
static-auth-secret=example-shared-secret-change-me
realm=huddle.example.test
fingerprint
no-tls
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.168.0.0-192.168.255.255
allowed-peer-ip=172.30.0.50
user-quota=4
total-quota=100
verbose

docker network create --subnet 172.30.0.0/24 security-net
docker run -d --name turn --network security-net --ip 172.30.0.10 -p 18200:3478/udp \
  -v "$PWD/turnserver.conf:/etc/coturn/turnserver.conf:ro" coturn/coturn:4.18.0 -c /etc/coturn/turnserver.conf
docker run -d --name peer --network security-net --ip 172.30.0.50 --entrypoint sleep coturn/coturn:4.18.0 600

for peer in 172.30.0.50 172.30.0.99 169.254.169.254 10.0.0.5 127.0.0.1; do
  echo "== peer $peer"
  docker exec peer turnutils_uclient -W example-shared-secret-change-me -u user1 -n 1 -c -e $peer 172.30.0.10 \
    | grep -i error
done

== peer 172.30.0.50
== peer 172.30.0.99
... INFO channel bind: error 403 ()
== peer 169.254.169.254
... INFO channel bind: error 403 ()
== peer 10.0.0.5
... INFO channel bind: error 403 ()
== peer 127.0.0.1
... INFO channel bind: error 403 ()