Aiohttp: websocket message size limit

[alexmna...@gmail.com]

Hi all!

Before creating an issue, I wanted to discuss the following: aiohttp has no limit on websocket message sizes.

That looks pretty dangerous, as it allows to DoS/OOM the server with a single client without any effort at all.

Closest 'conceptual' relative of aiohttp (IMHO) aka tornado has this limit both on client and on server APIs:

http://www.tornadoweb.org/en/stable/websocket.html#tornado.websocket.WebSocketHandler

http://www.tornadoweb.org/en/stable/websocket.html#tornado.websocket.WebSocketClientConnection

It cannot be implemented on the application layer - it's too late, message has been fully loaded already. This limit must be deep in protocol implementation, where websocket fragmented messages are collected.

Am I missing smth?

ps. I understand that it can probably solved using a production reverse proxy, but for pure WS workload direct connection seems reasonable too.

[alexmna...@gmail.com]

Btw, does client_max_size (which is not documented?) influence websockets?

[Nikolay Kim]

client_max_size does not influence websockets parser at all. As an temp solution we should take this value into account. Proper solution would be to use StreamReader instead of plain text and bytes. 

Sent from my iPhone

--
You received this message because you are subscribed to the Google Groups "aio-libs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to aio-libs+u...@googlegroups.com.
To post to this group, send email to aio-...@googlegroups.com.
Visit this group at https://groups.google.com/group/aio-libs.
To view this discussion on the web visit https://groups.google.com/d/msgid/aio-libs/d1a8b651-4c77-461f-a446-04d433e31057%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Alexey Nazarenko]

I'm not sure if it's right to expose streaming APIs for the inherently message-based protocol. 

It's your decision, ofc, but the simple hard-limit (both on client and server APIs) looks good for me.

[Alexey Nazarenko]

Should I create an issue in the tracker?

[Nikolay Kim]

sure. PR would be even better

To view this discussion on the web visit https://groups.google.com/d/msgid/aio-libs/51feea3b-739f-47d4-86ac-c80bbf994e95%40googlegroups.com.

[Amirouche Boubekki]

Can you cross link the PR/Issue here please?

[Alexey Nazarenko]

Sure, here is the issue:

https://github.com/aio-libs/aiohttp/issues/1952