WebsocketRouteOptionsType

Defined in: src/http/websocket/WebsocketRouteOptions.ts:32

The options a websocket() route may carry — codec + per-connection policy.

Extends

• WebsocketPolicyOptions

Type Parameters

TOut

TOut

TIn

TIn

Properties

allowedOrigins?

readonly optional allowedOrigins?: readonly string[]

Defined in: src/http/websocket/WebsocketRouteOptions.ts:48

Allowed browser Origins for the upgrade handshake — the defence against Cross-Site WebSocket Hijacking (CSWSH). When set, an upgrade whose Origin header is present but not in this list is rejected with 403. A missing Origin (non-browser client: native WebSocket, server-to-server) is allowed — CSWSH rides a victim browser’s ambient cookie/session credentials, so a request without an Origin can’t be that attack. Comparison is case-insensitive. Unset → no origin check.

Bearer-token auth is already resistant (browsers can’t set the Authorization header on a WS handshake); set this when the route’s auth is ambient (cookie / IpAllowlist).

---

codec?

readonly optional codec?: WebsocketCodec<TOut, TIn>

Defined in: src/http/websocket/WebsocketRouteOptions.ts:34

Wire codec. Default: jsonCodec<TOut, TIn>().

---

maxBufferedBytes?

readonly optional maxBufferedBytes?: number

Defined in: src/http/websocket/WebsocketPolicy.ts:38

Inherited from

WebsocketPolicyOptions.maxBufferedBytes

---

maxConnections?

readonly optional maxConnections?: number

Defined in: src/http/websocket/WebsocketPolicy.ts:40

Inherited from

WebsocketPolicyOptions.maxConnections

---

maxFrameBytes?

readonly optional maxFrameBytes?: number

Defined in: src/http/websocket/WebsocketPolicy.ts:35

Inherited from

WebsocketPolicyOptions.maxFrameBytes

---

onBackpressure?

readonly optional onBackpressure?: BackpressurePolicy

Defined in: src/http/websocket/WebsocketPolicy.ts:39

Inherited from

WebsocketPolicyOptions.onBackpressure

---

onInvalidMessage?

readonly optional onInvalidMessage?: InvalidMessagePolicy

Defined in: src/http/websocket/WebsocketPolicy.ts:37

Inherited from

WebsocketPolicyOptions.onInvalidMessage

---

onOversizeFrame?

readonly optional onOversizeFrame?: OversizeFramePolicy

Defined in: src/http/websocket/WebsocketPolicy.ts:36

Inherited from

WebsocketPolicyOptions.onOversizeFrame

---

requireSameOrigin?

readonly optional requireSameOrigin?: boolean

Defined in: src/http/websocket/WebsocketRouteOptions.ts:67

Accept an upgrade whose Origin names this same server, without having to enumerate the origins up front. Use it when the page driving the socket is served by the server itself and you cannot know the host in advance — behind a port-forward, a container hostname or a developer’s localhost on an arbitrary port.

Combines with allowedOrigins: an upgrade passes when the Origin matches the request’s own Host or appears in the list. A missing Origin is allowed for the same reason it is there — CSWSH needs a browser, and a browser always sends one.

The comparison is host-only, because Host carries no scheme to compare against. A reverse proxy that rewrites Host but not Origin will therefore fail the check; list the real origins instead.

Default: false (unset → no origin check, as before).