Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Abort connection on receiving non-sequential request ID #293

Open
KSDaemon opened this issue Feb 22, 2023 · 1 comment
Open

Abort connection on receiving non-sequential request ID #293

KSDaemon opened this issue Feb 22, 2023 · 1 comment
Assignees
Labels

Comments

@KSDaemon
Copy link
Collaborator

Right now Nexus doesn't take into account the request ID sequence number. That is not aligned with WAMP SPEC.

Under IDs:

IDs in the session scope MUST be incremented by 1 beginning with 1 (for each direction - Client-to-Router and Router-to-Client) {#session_scope_id}

And under Protocol Errors (recently added in PR wamp-proto/wamp-proto#437):

Receiving message with non-sequential session scope request ID, such as SUBSCRIBE, UNSUBSCRIBE, PUBLISH, REGISTER, UNREGISTER, CALL and YIELD.

And further below:

In all such cases WAMP implementations:

  1. MUST send an ABORT message to the offending peer, having reason wamp.error.protocol_violation and optional attributes in ABORT.Details such as a human readable error message.
  2. MUST abort the WAMP session by disposing any allocated subscriptions/registrations for that particular client and without waiting for or processing any messages subsequently received from the peer,
  3. SHOULD also drop the WAMP connection at transport level (recommended to prevent denial of service attacks)
@KSDaemon KSDaemon self-assigned this Feb 22, 2023
@KSDaemon KSDaemon added the bug label Feb 22, 2023
@KSDaemon
Copy link
Collaborator Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant