Appropriate usage of read and write deadlines

[ldelossa]

Hello,

I did a bit of digging and see that time.Duration is not possible when setting read and write timeouts. That being said, what is the appropriate usage of deadline?

If I have a WS connection where I only read an initial "init" message, and then never read again, do I just let that read timeout die?

Is gorilla package setting a default timeout? My concern is that my server be vulnerable to idle websocket attacks if there's no read deadline in place.

Add the current time to a timeout to get a deadline:

 ws.SetWriteDeadline(time.Now().Add(timeout))
 err := ws.WriteMessage(websocket.Binary, data)

The application must continue reading the connection after receiving the initial "init" message (documentation). If the application sends PINGs, then application should apply a deadline for reading the PONGs. If the application does not send PINGs, then the application should clear the deadline with ws.SetReadDeadline(time.TIme{}) after reading the "init" message.

The package does not set a default timeout or deadline.

A server that does not set read deadlines is indeed vulnerable to idle attacks. Best practice is to use PING/PONG and read deadlines as shown in the examples for this package.

[ldelossa]

@ghost

Just a follow up question here, is Gorilla sending ping/pong control messages on it's own without a handler implemented? And do browsers typically send ping/pong messages on their own without writing the code to do so ?

[elithrar]

@ldelossa gorilla/websocket responses to ping messages with a pong, by default. It does not send ping messages on its own.

As per https://godoc.org/github.com/gorilla/websocket#hdr-Control_Messages

Connections handle received ping messages by calling the handler function set with the SetPingHandler method. The default ping handler sends a pong message to the peer.

Browsers don't send pings on their own, except in rare case, but they do automatically respond to pong messages.

Hope this clarifies.

[elithrar]

PS: If you have other questions on control frames, open a new issue and we can discuss there!

[ldelossa]

@elithrar thanks! much appreciated.