Security¶
Encryption¶
In production, you should always secure WebSocket connections with TLS.
Secure WebSocket connections provide confidentiality and integrity, as well as better reliability because they reduce the risk of interference by bad proxies.
WebSocket servers are usually deployed behind a reverse proxy that terminates TLS. Else, you can configure TLS for the server.
Memory usage¶
Warning
An attacker who can open an arbitrary number of connections will be able to perform a denial of service by memory exhaustion. If you’re concerned by denial of service attacks, you must reject suspicious connections before they reach websockets, typically in a reverse proxy.
With the default settings, opening a connection uses 70 KiB of memory.
Sending some highly compressed messages could use up to 128 MiB of memory with an amplification factor of 1000 between network traffic and memory usage.
Configuring a server to optimize memory usage will improve security in addition to improving performance.
HTTP limits¶
In the opening handshake, websockets applies limits to the amount of data that it accepts in order to minimize exposure to denial of service attacks.
The request or status line is limited to 8192 bytes. Each header line, including the name and value, is limited to 8192 bytes too. No more than 128 HTTP headers are allowed. When the HTTP response includes a body, it is limited to 1 MiB.
You may change these limits by setting the WEBSOCKETS_MAX_LINE_LENGTH
,
WEBSOCKETS_MAX_NUM_HEADERS
, and WEBSOCKETS_MAX_BODY_SIZE
environment variables respectively.
Identification¶
By default, websockets identifies itself with a Server
or User-Agent
header in the format "Python/x.y.z websockets/X.Y"
.
You can set the server_header
argument of serve()
or
the user_agent_header
argument of connect()
to
configure another value. Setting them to None
removes the header.
Alternatively, you can set the WEBSOCKETS_SERVER
and
WEBSOCKETS_USER_AGENT
environment variables respectively. Setting them
to an empty string removes the header.
If both the argument and the environment variable are set, the argument takes precedence.