WebSockets

Presentation

WebSocket is a protocol providing persistent communication channels over TCP

For ft_transcendence, websockets are privileged over HTTP when:

• real-time communication is needed, ie for the game
• we want to minimize network traffic : sending only necessary data payloads once the connection is open.

Architecture choices

We could have a dedicated WebSocket gateway (as for the API Gateway service), but the use of WebSocket is limited to game.

Do's and Don'ts

✅ Do	❌ Don't
Use wss:// (WebSocket Secure): Always encrypt traffic with TLS to prevent Man-in-the-Middle attacks.	Send sensitive data over ws://: Insecure connections expose tokens and private messages.
Implement Heartbeats: Use ping/pong mechanisms to detect and clean up "zombie" connections.	-
Validate and sanitize messages	Trust Client Input: risk of injections.
Offload Auth to Handshake: Use JWTs or "tickets" during the initial HTTP upgrade request.	Re-authenticate on every message: This adds unnecessary latency and processing overhead.

---

Useful Resources

Type	Resource	Notes
📦	fastify-websocket	-
📄	OWASP WebSocket Security	Best practices for securing persistent connections.