Securing websockets #1802
Merged
Securing websockets #1802
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Reviewer's GuideThis PR secures the WebSocket handshake by extracting the client’s remote address from the socket, evaluating whether it corresponds to localhost (IPv4, IPv6, or IPv4‐mapped), and conditioning the Engine.IO handshake acceptance on both the presence of the EIO parameter and the isLocalhost check. Sequence diagram for secured WebSocket handshakesequenceDiagram
participant Client
participant WebsocketController
participant Socket
Client->>WebsocketController: Initiate WebSocket handshake (with EIO param)
WebsocketController->>Socket: Extract remoteAddress
WebsocketController->>WebsocketController: Check if remoteAddress is localhost
alt EIO param present AND isLocalhost
WebsocketController-->>Client: Accept handshake
else
WebsocketController-->>Client: Reject handshake
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey @frieck - I've reviewed your changes and they look great!
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `src/api/integrations/event/websocket/websocket.controller.ts:31` </location>
<code_context>
allowRequest: async (req, callback) => {
try {
const url = new URL(req.url || '', 'http://localhost');
+ const isInternalConnection = req.socket.remoteAddress === '127.0.0.1' || req.socket.remoteAddress === '::1';
const params = new URLSearchParams(url.search);
</code_context>
<issue_to_address>
Consider handling IPv6-mapped IPv4 addresses for localhost.
Also include '::ffff:127.0.0.1' in the internal connection check to cover IPv6-mapped IPv4 localhost addresses.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
const isInternalConnection = req.socket.remoteAddress === '127.0.0.1' || req.socket.remoteAddress === '::1';
=======
const isInternalConnection =
req.socket.remoteAddress === '127.0.0.1' ||
req.socket.remoteAddress === '::1' ||
req.socket.remoteAddress === '::ffff:127.0.0.1';
>>>>>>> REPLACE
</suggested_fix>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| allowRequest: async (req, callback) => { | ||
| try { | ||
| const url = new URL(req.url || '', 'http://localhost'); | ||
| const isInternalConnection = req.socket.remoteAddress === '127.0.0.1' || req.socket.remoteAddress === '::1'; |
Contributor
There was a problem hiding this comment.
suggestion: Consider handling IPv6-mapped IPv4 addresses for localhost.
Also include '::ffff:127.0.0.1' in the internal connection check to cover IPv6-mapped IPv4 localhost addresses.
Suggested change
| const isInternalConnection = req.socket.remoteAddress === '127.0.0.1' || req.socket.remoteAddress === '::1'; | |
| const isInternalConnection = | |
| req.socket.remoteAddress === '127.0.0.1' || | |
| req.socket.remoteAddress === '::1' || | |
| req.socket.remoteAddress === '::ffff:127.0.0.1'; |
Contributor
Author
|
@sourcery-ai review |
| const url = new URL(req.url || '', 'http://localhost'); | ||
| const params = new URLSearchParams(url.search); | ||
|
|
||
| const remoteAddress = req.socket.remoteAddress; |
Contributor
There was a problem hiding this comment.
suggestion (code-quality): Prefer object destructuring when accessing and using properties. (use-object-destructuring)
Suggested change
| const remoteAddress = req.socket.remoteAddress; | |
| const {remoteAddress} = req.socket; |
Explanation
Object destructuring can often remove an unnecessary temporary reference, as well as making your code more succinct.From the Airbnb Javascript Style Guide
Contributor
Author
|
@sourcery-ai review |
Contributor
There was a problem hiding this comment.
Hey @frieck - I've reviewed your changes - here's some feedback:
- Consider using a CIDR-based or net.isLoopback utility instead of hardcoding specific loopback address strings to cover all IPv4/IPv6 variants.
- If the app sits behind a reverse proxy, req.socket.remoteAddress might not reflect the original client; ensure you handle X-Forwarded-For headers or configure trusted proxies.
- You could extract the localhost check into a reusable helper to keep the controller code concise and improve testability.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider using a CIDR-based or net.isLoopback utility instead of hardcoding specific loopback address strings to cover all IPv4/IPv6 variants.
- If the app sits behind a reverse proxy, req.socket.remoteAddress might not reflect the original client; ensure you handle X-Forwarded-For headers or configure trusted proxies.
- You could extract the localhost check into a reusable helper to keep the controller code concise and improve testability.
## Individual Comments
### Comment 1
<location> `src/api/integrations/event/websocket/websocket.controller.ts:34` </location>
<code_context>
const params = new URLSearchParams(url.search);
+ const { remoteAddress } = req.socket;
+ const isLocalhost =
+ remoteAddress === '127.0.0.1' || remoteAddress === '::1' || remoteAddress === '::ffff:127.0.0.1';
+
// Permite conexões internas do Socket.IO (EIO=4 é o Engine.IO v4)
</code_context>
<issue_to_address>
Consider IPv6-mapped IPv4 and proxy scenarios for localhost detection.
This check may not handle all localhost scenarios, such as alternative IPv6-mapped formats or proxy headers like X-Forwarded-For. Consider updating the logic or documenting these limitations if relevant to your deployment.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+34
to
+35
| const isLocalhost = | ||
| remoteAddress === '127.0.0.1' || remoteAddress === '::1' || remoteAddress === '::ffff:127.0.0.1'; |
Contributor
There was a problem hiding this comment.
suggestion: Consider IPv6-mapped IPv4 and proxy scenarios for localhost detection.
This check may not handle all localhost scenarios, such as alternative IPv6-mapped formats or proxy headers like X-Forwarded-For. Consider updating the logic or documenting these limitations if relevant to your deployment.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixing publicly exposed WebSocket endpoints.
Summary by Sourcery
Restrict WebSocket Engine.IO handshake to only allow connections from localhost
Bug Fixes:
Enhancements: