Anti-DoS WebSockets Best Practices

These days it's near impossible to thwart a traffic based DoS without some kind of hefty physical firewall in the network. However, if you're talking about other forms of DoS then there are a few things you can do to help.

  • Use asynchronous/non-blocking sockets. A malicious user could open up any number of connections to your sockets consuming all of your available threads. (Slowloris Vulnerability)

  • Control how many request-per-second a user can submit to ensure they aren't flooding your socket

  • Ensure the user cannot make the server perform anything too resource intensive


tl;dr:

"Yes, WebSocket is the first way to open an unlimited number of connections to a single server, so it indeed likely needs additional protection to prevent DOS attacks. But we don't really have a way to implement this correctly ..." (https://bugs.webkit.org/show_bug.cgi?id=32246#c4)


since i'm interested in that topic too, but dont have the time to read all the sources, i'll start this as a collection of (hopefully) useful links; comments to each link appreciated

  • WebSocket Security Analysis (PDF)
  • The Dangers of HTML5: WebSockets and Stable Standards (MSDN)
  • WebSocket Security (Heroku)
  • Websockets 101 (pocoo) (mostyl the lessons learned section)

update 1 (esp. Blackhat-Presentation)

  • Hacking with WebSockets / BlackHat 2012, esp. Sections: Denial of Service - Server / Deploy WebSockets Securely / Secure protocol for WebSockets

  • HTML5 WebSockets - security & new tool for attacking

  • HTML5 Web Sockets Changes the Scalability Game