Rate Limiting Real-Time Events Per Client Prevents WebSocket Abuse

A WebSocket server accepts messages from clients without rate limiting. A malicious or buggy client sends thousands of messages per second, consuming CPU and memory and degrading the experience for all other clients.

Implement a per-connection token bucket rate limiter. If a client exceeds the rate limit, drop messages or close the connection with a policy violation code.

class TokenBucket {
  private tokens: number;
  private lastRefill: number;

  constructor(
    private capacity: number,
    private refillRate: number // tokens per ms
  ) {
    this.tokens = capacity;
    this.lastRefill = Date.now();
  }

  consume(n = 1): boolean {
    const now = Date.now();
    const elapsed = now - this.lastRefill;
    this.tokens = Math.min(this.capacity, this.tokens + elapsed * this.refillRate);
    this.lastRefill = now;

    if (this.tokens >= n) {
      this.tokens -= n;
      return true;
    }
    return false;
  }
}

// Per-connection rate limiter: 50 messages/second, burst of 100
wss.on('connection', (ws) => {
  const limiter = new TokenBucket(100, 50 / 1000);

  ws.on('message', (data) => {
    if (!limiter.consume()) {
      ws.send(JSON.stringify({ error: 'rate_limited' }));
      return;
    }
    handleMessage(ws, data);
  });
});

WebSocket servers have no built-in rate limiting. Unlike HTTP, where each request is a separate connection, a single WebSocket client can send unbounded messages over one long-lived connection. Without a gate, one client can monopolize the server.