fix: harden websocket limits

Author: NateIsern

.env.example

@@ -15,6 +15,7 @@ WEBSOCKET_NETWORKS=mainnet
 BLOCKCHAIN_POLL_INTERVAL=10000
 WEBSOCKET_HEARTBEAT_INTERVAL=30000
 WEBSOCKET_MAX_CONNECTIONS_PER_IP=5
+WEBSOCKET_MAX_PAYLOAD_BYTES=65536
 
 # App Configuration
 # Public origin allowed by the API CORS allowlist (server-side). Defaults to

README.md

@@ -65,6 +65,7 @@ WEBSOCKET_NETWORKS=mainnet          # comma-separated; add testnet if you run a
 BLOCKCHAIN_POLL_INTERVAL=10000
 WEBSOCKET_HEARTBEAT_INTERVAL=30000
 WEBSOCKET_MAX_CONNECTIONS_PER_IP=5
+WEBSOCKET_MAX_PAYLOAD_BYTES=65536
 
 # Public origin allowed by the API CORS allowlist
 PUBLIC_BASE_URL=https://explorer.fairco.in

server/index.ts

@@ -27,10 +27,11 @@ import packageJson from '../package.json' with { type: 'json' }
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const app = express()
 const PORT = parseInt(process.env.PORT || '8080', 10)
+const WEBSOCKET_MAX_PAYLOAD_BYTES = parseInt(process.env.WEBSOCKET_MAX_PAYLOAD_BYTES || '65536', 10)
 
 // Behind one reverse proxy (e.g. nginx/DO app platform): trust a single hop so
 // `req.ip` and the rate limiter use the real client IP, not a spoofable header.
-// The same hop count is used to resolve the WebSocket client IP (see resolveClientIp).
+// WebSocket connection limits intentionally use the TCP peer address instead.
 const TRUST_PROXY_HOPS = 1
 app.set('trust proxy', TRUST_PROXY_HOPS)
 
@@ -567,7 +568,12 @@ app.use((_req, res) => {
 const server = createServer(app)
 
 // WebSocket setup
-const wss = new WebSocketServer({ noServer: true })
+const wss = new WebSocketServer({
+  noServer: true,
+  maxPayload: Number.isFinite(WEBSOCKET_MAX_PAYLOAD_BYTES) && WEBSOCKET_MAX_PAYLOAD_BYTES > 0
+    ? WEBSOCKET_MAX_PAYLOAD_BYTES
+    : 65536,
+})
 
 server.on('upgrade', (request, socket, head) => {
   const { pathname } = parse(request.url || '', true)
@@ -602,27 +608,14 @@ function loadWsHandler(): Promise<WebSocketHandlerModule | null> {
 /**
  * Resolve the client IP for the per-IP WebSocket connection cap.
  *
- * A raw client can put any value in `X-Forwarded-For`, so trusting its left-most
- * entry lets attackers bypass the per-IP limit. With one trusted proxy
- * (`trust proxy = 1`), the authoritative client address is the entry our proxy
- * appended — the right-most XFF value — falling back to the real TCP peer
- * address (`socket.remoteAddress`) when there is no proxy header.
+ * The WebSocket upgrade request can include a user-controlled
+ * `X-Forwarded-For` header, especially when the service is reachable directly
+ * or through a proxy that passes the header through. Key the unauthenticated
+ * connection cap by the TCP peer address instead of any forwarded header so a
+ * client cannot mint separate buckets by spoofing headers.
  */
-function resolveClientIp(request: { headers: NodeJS.Dict<string | string[]>; socket: { remoteAddress?: string } }): string | undefined {
-  const socketAddress = request.socket.remoteAddress
-  if (!TRUST_PROXY_HOPS) {
-    return socketAddress
-  }
-  const forwarded = request.headers['x-forwarded-for']
-  const raw = Array.isArray(forwarded) ? forwarded.join(',') : forwarded
-  if (raw) {
-    const parts = raw.split(',').map(part => part.trim()).filter(Boolean)
-    const trusted = parts[parts.length - 1]
-    if (trusted) {
-      return trusted
-    }
-  }
-  return socketAddress
+function resolveClientIp(request: { socket: { remoteAddress?: string } }): string | undefined {
+  return request.socket.remoteAddress
 }
 
 wss.on('connection', async (ws, request) => {