How to prevent web socket DDOS attacks?

Question

I just performed a basic DDOS from my computer:

websocket-bench -a 2500 -c 200 wss://s.example.com

Which to my total dismay crashed my server! The WS works by connecting to my nginx proxy:

    location / {
            proxy_pass http://sock;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header        X-Real-IP               $remote_addr;
            proxy_read_timeout 60;
    }

    upstream sock {
            server 127.0.0.1:1203 fail_timeout=1s;
    }

and locally on the server on port 1203 is ratchet. The setup for ratchet is that I allow any connection and the first onMessage performs authentication and if invalid the connection is closed.

I also have tried authentication by passing headers on the first connection and if invalid the socket closes but this has not helped at all and nginx still reaches 100% resources and then crashes.

What should I be analysing to prevent these crashes?

When changing the upstream to another closed port (i.e disabling it) the server still crashes.

Answer 1

Either change your authentication logic so Nginx handles it, or implement request and connection limits within Nginx to control how many connections are accepted and passed to the upstream server