Duplicate messages deduplicated via client-generated ID before rendering

Real-time transports retry delivery on network errors. Without deduplication, a message sent before a disconnect and resent after reconnect renders twice in the UI — the user sees duplicate chat lines, duplicate notifications, and potentially double-processed side effects. CWE-694 (Use of Multiple Resources with Duplicate Identifier) captures this integrity failure. The fix is straightforward but frequently omitted in AI-generated WebSocket code that copies the happy path without handling retry semantics.

Assign a client-generated ID to each outbound message and maintain a Set of received IDs on the client. Drop any message whose ID has already been processed.

// Receiving
const seen = new Set<string>();
socket.on('message', (msg: { id: string; content: string }) => {
  if (seen.has(msg.id)) return;
  seen.add(msg.id);
  renderMessage(msg);
});

// Sending
const send = (content: string) => {
  const id = nanoid(); // generated on the client
  socket.emit('send_message', { id, content });
};

Bound the seen Set to a recent window (last N messages or TTL) if memory is a concern — an unbounded Set grows without limit in long-lived sessions.