feat(server): token-based WebSocket authentication by chenjiahan · Pull Request #5531 · web-infra-dev/rsbuild

chenjiahan · 2025-07-04T04:00:39Z

Summary

Enhance the security and functionality of the WebSocket across the codebase:

Replacing the compilationId mechanism with secure WebSocket tokens.
Refactoring the socket server to support token-based communication.
Allow Rsbuild plugin to access the token via environmentContext.webSocketToken:

api.modifyRspackConfig((config, { environment }) => {
  console.log(environment.webSocketToken);
});

Checklist

Tests updated (or not required).
Documentation updated (or not required).

netlify · 2025-07-04T04:01:48Z

✅ Deploy Preview for rsbuild ready!

Name	Link
🔨 Latest commit	`d2a2194`
🔍 Latest deploy log	https://app.netlify.com/projects/rsbuild/deploys/6869f711cf5af700085e3d69
😎 Deploy Preview	https://deploy-preview-5531--rsbuild.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 76 (🔴 down 1 from production) Accessibility: 97 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: 60 (no change from production) View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull Request Overview

This PR replaces the previous compilationId mechanism with secure WebSocket tokens for development, updates the server and client to use token-based authentication, and removes obsolete compilation ID utilities.

Adds webSocketToken to the environment context and generates it in dev mode.
Refactors the socket server and middleware to authenticate and route messages by token.
Updates client HMR code to append and respect the new token parameter.

Reviewed Changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/core/src/types/hooks.ts	Add `webSocketToken` to `EnvironmentContext`
packages/core/src/server/socketServer.ts	Refactor upgrade, connection tracking, and messaging to use tokens
packages/core/src/server/helper.ts	Remove unused `getCompilationId` helper
packages/core/src/server/compilationMiddleware.ts	Update server hooks to use token instead of `compilationId`
packages/core/src/server/compilationManager.ts	Pass `environments` and tokens into middleware and socket server
packages/core/src/createContext.ts	Generate secure WebSocket tokens in dev mode
packages/core/src/client/hmr.ts	Append `token` to HMR URL and remove old `compilationId` logic

Comments suppressed due to low confidence (2)

packages/core/src/server/socketServer.ts:61

Add unit or integration tests for the WebSocket upgrade flow, covering valid and invalid token scenarios to ensure authentication logic behaves as expected.

  public upgrade = (

packages/core/src/types/hooks.ts:225

Public API docs (README or type reference) should be updated to reflect the new webSocketToken field and explain its usage in the environment API.

  webSocketToken: string;

packages/core/src/server/socketServer.ts

packages/core/src/createContext.ts

packages/core/src/client/hmr.ts

cursor

Bug: Compiler Index Mismatch Disables HMR

The setupCompiler function's signature changed to expect an index parameter. However, applyToCompiler may not pass this index, or the passed index (representing the compiler's position) may not consistently match the env.index used for webSocketToken lookup in options.environments. This mismatch or absence of index causes the token lookup to fail, leading setupCompiler to return early and silently disable HMR functionality for the affected compiler(s).

packages/core/src/server/compilationMiddleware.ts#L147-L174

rsbuild/packages/core/src/server/compilationMiddleware.ts

Lines 147 to 174 in d2a2194

    
           const setupCompiler = (compiler: Compiler, index: number) => { 
        
             const token = Object.values(options.environments).find( 
        
               (env) => env.index === index, 
        
             )?.webSocketToken; 
        
             if (!token) { 
        
               return; 
        
             } 
        
             if (clientPaths) { 
        
               applyHMREntry({ 
        
                 compiler, 
        
                 clientPaths, 
        
                 devConfig, 
        
                 resolvedClientConfig, 
        
                 token, 
        
               }); 
        
             } 
        
             // register hooks for each compilation, update socket stats if recompiled 
        
             setupServerHooks({ 
        
               compiler, 
        
               callbacks, 
        
               token, 
        
             }); 
        
           }; 
        
           applyToCompiler(compiler, setupCompiler);

Fix in Cursor • Fix in Web

Bug: WebSocket Token Overwrite Causes Untracked Connections

The SocketServer's sockets Map incorrectly handles multiple WebSocket connections sharing the same webSocketToken. When a new connection with an existing token is established, it overwrites the previous connection in the Map. However, the close handler of the old connection remains active and, upon its closure, removes the new, active connection from the Map. This causes active connections to become untracked, preventing them from receiving HMR/live-reload updates and breaking multi-tab development scenarios.

packages/core/src/server/socketServer.ts#L222-L227

rsbuild/packages/core/src/server/socketServer.ts

Lines 222 to 227 in d2a2194

    
           this.sockets.set(token, connection); 
        
           connection.on('close', () => { 
        
             this.sockets.delete(token); 
        
           });

packages/core/src/server/socketServer.ts#L37-L38

rsbuild/packages/core/src/server/socketServer.ts

Lines 37 to 38 in d2a2194


	private readonly sockets: Map<string, Ws> = new Map();

Fix in Cursor • Fix in Web

Was this report helpful? Give feedback by reacting with 👍 or 👎

See: web-infra-dev/rsbuild#5531

feat(server): token-based WebSocket authentication

de831d1

Copilot AI review requested due to automatic review settings July 4, 2025 04:00

Copilot AI reviewed Jul 4, 2025

View reviewed changes

packages/core/src/server/socketServer.ts Show resolved Hide resolved

packages/core/src/createContext.ts Outdated Show resolved Hide resolved

packages/core/src/client/hmr.ts Show resolved Hide resolved

This comment was marked as outdated.

Sign in to view

github-actions bot added the release: feature label Jul 4, 2025

chenjiahan added 2 commits July 4, 2025 13:46

fix: token for IE 11

72718e1

fix: ut

ab07733

This comment was marked as outdated.

Sign in to view

Merge branch 'main' into ws_token_0704

7b114c7

This comment was marked as outdated.

Sign in to view

fix

d2a2194

cursor bot reviewed Jul 6, 2025

View reviewed changes

chenjiahan merged commit a986484 into main Jul 6, 2025
12 checks passed

chenjiahan deleted the ws_token_0704 branch July 6, 2025 04:47

This was referenced Jul 6, 2025

docs: add webSocketToken to documentation #5548

Merged

release: 1.4.4 #5553

Merged

colinaaa added a commit to lynx-family/lynx-stack that referenced this pull request Jul 8, 2025

feat: token-based WebSocket authentication

1239ee5

See: web-infra-dev/rsbuild#5531

chenjiahan mentioned this pull request Aug 14, 2025

fix: failed to create multiple HMR connections #5844

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(server): token-based WebSocket authentication#5531

feat(server): token-based WebSocket authentication#5531
chenjiahan merged 5 commits intomainfrom
ws_token_0704

chenjiahan commented Jul 4, 2025

Uh oh!

netlify bot commented Jul 4, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


	const setupCompiler = (compiler: Compiler, index: number) => {
	const token = Object.values(options.environments).find(
	(env) => env.index === index,
	)?.webSocketToken;

	if (!token) {
	return;
	}

	if (clientPaths) {
	applyHMREntry({
	compiler,
	clientPaths,
	devConfig,
	resolvedClientConfig,
	token,
	});
	}
	// register hooks for each compilation, update socket stats if recompiled
	setupServerHooks({
	compiler,
	callbacks,
	token,
	});
	};

	applyToCompiler(compiler, setupCompiler);


	this.sockets.set(token, connection);

	connection.on('close', () => {
	this.sockets.delete(token);
	});

Uh oh!

Conversation

chenjiahan commented Jul 4, 2025

Summary

Related Links

Checklist

Uh oh!

netlify bot commented Jul 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for rsbuild ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Bug: Compiler Index Mismatch Disables HMR

Bug: WebSocket Token Overwrite Causes Untracked Connections

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify bot commented Jul 4, 2025 •

edited

Loading