middleware icon indicating copy to clipboard operation
middleware copied to clipboard

[node-ws] Upgrades every path to ws

Open iSuslov opened this issue 1 year ago • 1 comments

Only defined paths should be upgraded to websocket connection, others should be immediately dropped.

iSuslov avatar Aug 30 '24 08:08 iSuslov

+1

gabewillen avatar Sep 18 '24 19:09 gabewillen

Hey @yusukebe, I noticed you have recently worked on node-ws package. Could you please look at this issue?

iSuslov avatar Feb 04 '25 01:02 iSuslov

I only fixed the type definition. I'd like @nakasyou to take a look.

yusukebe avatar Feb 04 '25 08:02 yusukebe

Sorry, I can't understand the topic well.

nakasyou avatar Feb 05 '25 22:02 nakasyou

@iSuslov

Can you explain the problem and provide how we can reproduce it?

yusukebe avatar Feb 06 '25 10:02 yusukebe

@yusukebe sure, here is a simple websocket server:

import { serve } from '@hono/node-server';
import { createNodeWebSocket } from '@hono/node-ws';
import { Hono } from 'hono';

const app = new Hono();

const { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app });

app.get(
  '/ws',
  upgradeWebSocket((c) => ({
    onOpen(_event, ws) {
      console.log('opened');
      ws.send(new Date().toString());
    },
    onClose() {
      console.log('closed');
    },
  })),
);

const port = 3010;
console.log(`Server is running on http://localhost:${port}`);
const server = serve({ ...app, port });
injectWebSocket(server);
  • In a browser console create a new connection: new WebSocket('ws://localhost:3010/ws').
Image

All works as expected.

  • Now try with undeclared path: new WebSocket('ws://localhost:3010/unknown_path'):
Image

As you can see, instead of rejecting the request to undeclared path, it upgrades it to websocket connection and keeps it alive.

It should accept websocket connections only on defined paths.

iSuslov avatar Feb 06 '25 13:02 iSuslov

@iSuslov Sorry for the late reply. Thank you.

Hey @nakasyou Can you investigate it?

yusukebe avatar Mar 03 '25 05:03 yusukebe

Wasn't resolved with https://github.com/honojs/middleware/pull/973?

nakasyou avatar Mar 03 '25 07:03 nakasyou

@nakasyou Thanks! Exactly. I've tried to reproduce it, and the latest version works fine.

@iSuslov Can you close this issue?

yusukebe avatar Mar 03 '25 22:03 yusukebe