Uvicorn does not appear to support setting a web socket max message size.
Without such an option an attacker can overwhelm the memory of an application running within Uvicorn (a denial of service).
Other frameworks such as aiohttp, tornado and Sanic have max message size options. Hypercorn also has a max message size:
https://gitlab.com/pgjones/hypercorn/blob/master/hypercorn/config.py#L55
It is discussed/documented here: https://pgjones.gitlab.io/hypercorn/dos_mitigations.html#large-websocket-message
Cheers!
divad
All 6 comments
It would be worth looking at the wsproto and websockets packages here. Do either of them include a limit by default? (We support either)
tomchristie
on 23 Feb 2019
But either way, yes we should definitely have this as a configuration setting.
tomchristie
on 23 Feb 2019
Hey, any updates on this?
cgarciae
on 12 Jul 2019
@cgarciae Nope - we'd use this ticket if there was any progress.
If anyone wants to take a crack at a pull request for it I'd happily help review & get it in.
tomchristie
on 15 Jul 2019
It would be worth looking at the wsproto
I don't think wsproto has something for this (may have forgotten), but I do this in Hypercorn - firstly there is a config setting then it is checked in the message buffer. Also see Some commentary
pgjones
on 31 Jul 2019
Looks like #538 fixes this, but has been collecting dust? Needing to switch to a different web server just to have control over that option is unfortunate :(
Many thanks for your time spent on this project.
selimb
on 12 May 2020
Related issues
RobertoPrevato
路
3Comments
vikahl
路
4Comments
adriangallegos
路
6Comments
yezyilomo
路
5Comments
itayperl
路
3Comments
Most helpful comment
I don't think wsproto has something for this (may have forgotten), but I do this in Hypercorn - firstly there is a config setting then it is checked in the message buffer. Also see Some commentary