Heartbeat or ping on idle connections; zombie connections closed after configurable timeout

TCP connections broken by NAT timeouts, mobile network switches, or abrupt process kills do not send a FIN packet. Without a heartbeat, the server holds those socket objects open indefinitely, consuming memory and file descriptors for clients that will never respond again. Enough zombie connections degrade throughput for active users and can prevent new connections from being accepted. ISO 25010 reliability requires that the system detect and recover from failed connections rather than accumulate them silently.

Implement a server-side ping loop and close any socket that fails to respond within the timeout window.

const PING_INTERVAL = 30_000; // 30 s
const PONG_TIMEOUT  = 60_000; // 60 s

io.on('connection', (socket) => {
  let deadline: NodeJS.Timeout;

  const resetDeadline = () => {
    clearTimeout(deadline);
    deadline = setTimeout(() => socket.disconnect(true), PONG_TIMEOUT);
  };

  socket.on('pong', resetDeadline);

  const ping = setInterval(() => socket.emit('ping'), PING_INTERVAL);

  socket.on('disconnect', () => {
    clearInterval(ping);
    clearTimeout(deadline);
  });

  resetDeadline();
});

Socket.IO's built-in pingInterval/pingTimeout options can replace this boilerplate — set them explicitly in the Server constructor rather than relying on defaults.