decentraland / social-service-ea / 36774376308

91%

main: 91%

push

github

fix: treat a malformed websocket auth frame as a client rejection (#501)

* fix: treat a malformed websocket auth frame as a client rejection

Sentry: https://decentraland.sentry.io/issues/7713056598/ (SOCIAL-SERVICE-EA-3H)
Exception: SyntaxError (JSON.parse), culprit authenticateUser (controllers.handlers.uws:ws-handler)

authenticateUser passed the client's first frame straight to JSON.parse. A frame that is not
JSON raised a SyntaxError, which isExpectedAuthRejection cannot classify (it only knows the
middleware's 4xx RequestError). So every such frame was logged at error, sent to Sentry and
counted as a server_error. That is 32 events so far from 1.13.9 and 1.13.10. A JSON null
frame took a similar path: verify() threw a TypeError on it.

#473 kept this path reporting only because the error "never reached the middleware". The
fault is still the client's, the same as a malformed auth chain, which the middleware rejects
with a 400. parseAuthChainHeaders now raises that same 400 RequestError, with a fixed message
that never echoes the frame, when the frame is not JSON or not an object. It then leaves through
the existing path: warn, no Sentry, ws_auth_errors{type="client_rejected"}, 3003 close.

Catalyst 503s and unexpected throws inside verify() keep reporting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: reject non-string auth header values in the websocket auth frame

Review follow-up for SOCIAL-SERVICE-EA-3H (https://decentraland.sentry.io/issues/7713056598/).
It also covers SOCIAL-SERVICE-EA-3J (https://decentraland.sentry.io/issues/7713296423/).

An x-identity-timestamp sent as a JSON number passes the middleware's timestamp and expiry
checks, then crashes createPayload with "TypeError: firstOf(...)?.toLowerCase is not a
function" (3J). That throw is reported as a server error from a frame the client built.
parseAuthChainHeaders now rejects, with the same 400, any x-identity-* header whose value is
not a string or an array o... (continued)

2614 of 3015 branches covered (86.7%)

Branch coverage included in aggregate %.

14 of 14 new or added lines in 1 file covered. (100.0%)

6261 of 6714 relevant lines covered (93.25%)

93.77 hits per line