socket.io 安全性 - 也许只允许来自特定域?

问题描述

我构建了一个 websocket (node.js + socket.io) 服务，它将聚合客户端的数据(分辨率、点击等)并发送给我的管理员(通过 websockets).但是，我对安全性有一些担忧.在客户端，我的 websocket 服务器地址是这样公开的:

I build a websocket (node.js + socket.io) service that will aggregate data on clients (resolution, clicks etc) and send to my admin (via websockets). However I have some concerns about security. On client's side my websocket server address is exposed like this:

var socket = new io.Socket('127.0.0.1', {'port': 3000});

所以任何人都可以使用该地址并达到一百万个请求(这会导致我的服务器宕机).

so anyone can take that address and hit a milion requests (which will bring my server down).

如何保护我的套接字服务器?也许只允许来自我的域的套接字连接(如何)?

How to protect my socket server? Maybe only allow socket connections from my domain (how)?

推荐答案

您可以限制并发连接的客户端数量.例如，如果有 5000 个通过 WebSockets 主动连接的客户端，那么新的客户端将被拒绝，直到有一些空闲插槽"可供它们使用.

You can limit the number of concurrently connected clients. For example if there are 5000 actively connected clients through WebSockets, then new ones will be refused until there are some "free slots" for them.

也许只允许来自我的域的套接字连接(如何)?

客户端(浏览器)连接没有将您的域作为源".

Client (browser) connections doesn't have your domain as "origin".

这篇关于socket.io 安全性 - 也许只允许来自特定域?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！