Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 58e274c

Browse filesBrowse files
feat: decrease the default value of maxHttpBufferSize
This change reduces the default value from 100 mb to a more sane 1 mb. This helps protect the server against denial of service attacks by malicious clients sending huge amounts of data. Backported from 734f9d1
1 parent b9dee7b commit 58e274c
Copy full SHA for 58e274c

File tree

Expand file treeCollapse file tree

2 files changed

+2
-2
lines changed
Filter options
Expand file treeCollapse file tree

2 files changed

+2
-2
lines changed

‎README.md

Copy file name to clipboardExpand all lines: README.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ to a single process.
227227
- `upgradeTimeout` (`Number`): how many ms before an uncompleted transport upgrade is cancelled (`10000`)
228228
- `maxHttpBufferSize` (`Number`): how many bytes or characters a message
229229
can be, before closing the session (to avoid DoS). Default
230-
value is `10E7`.
230+
value is `1e6` (1MB).
231231
- `allowRequest` (`Function`): A function that receives a given handshake
232232
or upgrade request as its first parameter, and can decide whether to
233233
continue or not. The second argument is a function that needs to be

‎lib/server.js

Copy file name to clipboardExpand all lines: lib/server.js
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ function Server (opts) {
4040
this.pingTimeout = opts.pingTimeout || 5000;
4141
this.pingInterval = opts.pingInterval || 25000;
4242
this.upgradeTimeout = opts.upgradeTimeout || 10000;
43-
this.maxHttpBufferSize = opts.maxHttpBufferSize || 10E7;
43+
this.maxHttpBufferSize = opts.maxHttpBufferSize || 1e6;
4444
this.transports = opts.transports || Object.keys(transports);
4545
this.allowUpgrades = false !== opts.allowUpgrades;
4646
this.allowRequest = opts.allowRequest;

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.