Eric WagonerandClaude Fable 5
f0a264147f
The server code learns to distrust strangers: a 64KB WebSocket payload cap (the ws default is 100MB — an easy OOM on a 1GB droplet), a per-connection token-bucket rate limit, caps on concurrent sockets, total rooms, rooms per connection, pending transfer codes, and seats per myGames query. Player names are stripped of control characters and bounded at 24 chars, room codes at 8, serialized commands at 16KB before they touch the append-only log. Catch-up replays — a full game rebuild per request — get a 3-second cooldown. Unexpected exceptions now log server-side and send strangers a bare "internal error" instead of the exception text. One real bug found by the sweep: myGames compared the client's raw seat token against the stored hash, so the lobby ledger silently matched nothing since tokens were hashed at rest — and the comparison wasn't timing-safe either. It now goes through the same timingSafeEqual path as every other seat check, via a new exported seatTokenValid. The droplet tightens too: the game server binds loopback (HOST env) so port 8787 no longer answers the internet — it was reachable directly, plaintext, bypassing Caddy — and ufw now allows only ssh, 80, and 443. The systemd unit gains a sandbox (ProtectSystem=strict, ProtectHome, NoNewPrivileges, PrivateTmp, MemoryMax=700M so a runaway process is killed and restarted before it takes the box down) and execs tsx directly instead of through npx. Caddy adds HSTS, nosniff, frame-denial, and no-referrer headers; setup-droplet.sh records all of it for future rebuilds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>