decentraland / social-service-ea / 36678426143

91%

main: 91%

Build Type

Pull #501

github

Committed by decentraland-bot

Commit Message

fix: treat a malformed websocket auth frame as a client rejection

Sentry: https://decentraland.sentry.io/issues/7713056598/ (SOCIAL-SERVICE-EA-3H)
Exception: SyntaxError (JSON.parse), culprit authenticateUser (controllers.handlers.uws:ws-handler)

authenticateUser passed the client's first frame straight to JSON.parse. A frame that is not
JSON raised a SyntaxError, which isExpectedAuthRejection cannot classify (it only knows the
middleware's 4xx RequestError). So every such frame was logged at error, sent to Sentry and
counted as a server_error. That is 32 events so far from 1.13.9 and 1.13.10. A JSON null
frame took a similar path: verify() threw a TypeError on it.

#473 kept this path reporting only because the error "never reached the middleware". The
fault is still the client's, the same as a malformed auth chain, which the middleware rejects
with a 400. parseAuthChainHeaders now raises that same 400 RequestError, with a fixed message
that never echoes the frame, when the frame is not JSON or not an object. It then leaves through
the existing path: warn, no Sentry, ws_auth_errors{type="client_rejected"}, 3003 close.

Catalyst 503s and unexpected throws inside verify() keep reporting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Pull Request Pull Request #501: fix: treat a malformed websocket auth frame as a client rejection

Coverage Stats

2606 of 3006 branches covered (86.69%)

Branch coverage included in aggregate %.

14 of 14 new or added lines in 1 file covered. (100.0%)

9 existing lines in 1 file now uncovered.

6255 of 6708 relevant lines covered (93.25%)

93.59 hits per line