How to set asymmetric limits on WebSocket message size?

[mkpankov]

In axum, there's this WS setting:
https://docs.rs/axum/latest/axum/extract/struct.WebSocketUpgrade.html#method.max_message_size

In our project, we'd like to limit messages clients are allowed to send over WS to something really small compared to the default - like 40 KB. At the same time, we'd like to set no limit on messages sent by the server (or set a much higher limit, like 2MB).

This is to, at least, prevent resource exhaustion / DoS attacks where server would read big messages that would consume server memory.

I understand it's not straightforward, so I'd like to hear some ideas on what to research, is it possible at all, and does it make sense.

[davidpdrsn]

axum uses https://crates.io/crates/tokio-tungstenite for web sockets so it would have to be supported there. Are you able to have a look at their docs?

[mkpankov]

Makes sense, I've forwarded the question there

[mkpankov]

So it looks like it should be possible to wrap tungstenite stream at higher level (meaning axum I suppose).
Do you think such implementation is possible?

[davidpdrsn]

Could you wrap https://docs.rs/axum/0.6.20/axum/extract/ws/struct.WebSocket.html instead? All it does is forward directly to tungstenite so I’m not sure anything would need to be built in to axum’s wrapper.

[mkpankov]

@davidpdrsn I'll try doing that, thanks for suggestion