Per-user connection limits enforced to prevent slot exhaustion

Without a per-user connection ceiling, a single authenticated user — or a compromised account — can open thousands of simultaneous WebSocket connections. Each consumes a file descriptor, memory, and CPU for keepalive processing. At scale this constitutes a low-cost denial-of-service attack that degrades or crashes the server for every other user. CWE-770 (Allocation of Resources Without Limits) captures exactly this failure mode, and ISO 25010 performance-efficiency requires that resource consumption be bounded under adversarial load.

Track open connections per user in a server-side Map and reject the handshake once the limit is reached. Cap at 3–5 for most community apps.

const userConnections = new Map<string, Set<string>>();
const MAX_CONNECTIONS_PER_USER = 3;

io.use((socket, next) => {
  const userId = socket.userId;
  const conns = userConnections.get(userId) ?? new Set();
  if (conns.size >= MAX_CONNECTIONS_PER_USER) {
    return next(new Error('Connection limit reached'));
  }
  conns.add(socket.id);
  userConnections.set(userId, conns);
  socket.on('disconnect', () => conns.delete(socket.id));
  next();
});

The limit must be enforced in the middleware, not just configuration — a configured but unread value is not enforced.