Websockets Ping Attack Prevention

[ivanthewebber]

I've been doing some threat modeling on new websockets endpoints, and one type of attack that I'm wondering about is a DOS ping attack where a few websockets are used to send a large number of pings to the server without waiting for the pongs and still handling server-sent pings.

Could uvicorn add an argument that closes websockets if they send more than N messages in less than M milliseconds? That would also prevent users from needing to add similar checks in their application code that might handle larger messages with more expensive processing.

Assuming other DOS attacks are protected against I think the risk is low because the payload is small and the response is cheap and the attacker is likely to miss their own ping response, but I'm not convinced so I'd like to hear from the Uvicorn devs.