feat: decrease the default value of maxHttpBufferSize

This change reduces the default value from 100 mb to a more sane 1 mb. This helps protect the server against denial of service attacks by malicious clients sending huge amounts of data.
socketio · Feb 11, 2020 · 734f9d1 · 734f9d1 · abergmann · Jan 8, 2021
1 parent 61b9492
commit 734f9d1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/server.js b/lib/server.js
@@ -26,7 +26,7 @@ class Server extends EventEmitter {
         pingTimeout: 5000,
         pingInterval: 25000,
         upgradeTimeout: 10000,
-        maxHttpBufferSize: 10e7,
+        maxHttpBufferSize: 1e6,
         transports: Object.keys(transports),
         allowUpgrades: true,
         perMessageDeflate: {