Reject malicious large WebSocket messages?

dli · March 20, 2026, 8:16pm

lib/phoenix/transports/long_poll.ex

ef11892fd


      
          defp safe_decode64!(base64) do
            if byte_size(base64) <= @max_base64_size do
              Base.decode64!(base64)
            else
              raise Plug.BadRequestError
            end
          end

Looks like there is a binary size limit for certain payload types. It is hardcoded to 10MB.

To summarize:

LiveView uses multiple transports like WebSockets and HTTP Long Polling via Phoenix.Channel behaviour
Every transport protocol needs to individually mitigate overly large payloads
WebSocket: :max_frame_size option is configurable, passed to WebSockAdapter — WebSockAdapter v0.5.9, then handled by Bandit — Bandit v1.10.3 or Nine Nines: cowboy_websocket(3)
Long Polling: request body limit for JSON only applies to binaries (hardcoded to 10MB) phoenix/lib/phoenix/transports/long_poll.ex at main · phoenixframework/phoenix · GitHub

socket "/ws/admin", MyApp.AdminUserSocket, # or Phoenix.LiveView.Socket
  longpoll: true,
  websocket: [max_frame_size: 10_000_000] # 10 MB