maxconnections exploit maybe

[miwarnec]

copy paste from discord:

"here's an exploit: connect maxConnection clients, send ping/pong (low performance cost) but not ready/addplayer. boom no new clients can join the server"

[imerr]

Good fix would be to not count unauthenticated connections towards the limit + timeout if you don't auth within x seconds - that at least raises the barrier a bit

[miwarnec]

Good fix would be to not count unauthenticated connections towards the limit + timeout if you don't auth within x seconds - that at least raises the barrier a bit

yes, that's what I do in Mirror 2 code as well.

• connecting
• lobby
• world

3 different connections, with 3 different limits and timeouts.