
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
rpc-websocketserver
Advanced tools
Simple rpc websocket server, wrapping the very popular 'ws' library. Register your RPCs with convenient decorators.
A simple and extensively documented typescript focused lib, to implement/prototype rpc websocket server applications with convenient decorators.
Wraps the popular ws lib.
Note: This is a backend focused library and therefore does not work in the browser.
With yarn (incl. peer dependencies)
yarn add rpc-websocketserver ws
With npm (incl. peer dependencies)
npm install rpc-websocketserver ws
Add experimental decorators and emit metadata to your tsconfig.json
// tsconfig.json
{
"compilerOptions": {
...
"experimentalDecorators": true,
"emitDecoratorMetadata": true
},
...
}
import { WebSocketServer, register, param } from 'rpc-websocketserver';
// inherit from WebSocketServer
class NamespaceA extends WebSocketServer {
constructor(messageHandler: MessageHandler, options: WebSocket.ServerOptions) {
super(messageHandler, options);
}
@register() // use the '@register' decorator to add function to the registered namespace methods
sum(@param('a') a: number, @param('b') b: number) { // use the '@param' decorator to expose parameters
return a + b;
}
@register('bar') // optional: register a function with a specific name instead of the function name
foo(@param('a') a: number, @param('b') b: number) { // use the '@param' decorator to expose parameters
return a + b;
}
}
// inherit from WebSocketServer
class NamespaceB extends WebSocketServer {
constructor(messageHandler: MessageHandler, options: WebSocket.ServerOptions) {
super(messageHandler, options);
}
@register() // use the '@register' decorator to add function to the registered namespace methods
substract(@param('a') a: number, @param('b') b: number) { // use the '@param' decorator to expose parameters
return a - b;
}
@register('foo') // optional: register a function with a specific name instead of the function name
bar(@param('a') a: number, @param('b') b: number) { // use the '@param' decorator to expose parameters
return a - b;
}
}
Set up your ws server similar like you would in the ws example and add your own namespaces
import express from 'express';
import http from 'http';
import url from 'url';
import { JSONRPC2MessageHandler } from 'rpc-websocketserver';
import { SimpleMessageHandler } from 'rpc-websocketserver';
const app = express();
const server = http.createServer(app);
// pass message handler instances and WebSocket.ServerOptions to the respective namespaces
const namespaceA = new NamespaceA(new SimpleMessageHandler(), { noServer: true });
// use different message handlers for different namespaces
const namespaceB = new NamespaceB(new JSONRPC2MessageHandler(), { noServer: true });
server.on('upgrade', function upgrade(request, socket, head) {
const { pathname } = url.parse(request.url);
if (pathname === '/a') {
namespaceA.wss.handleUpgrade(request, socket, head, function done(ws: any) {
namespaceA.wss.emit('connection', ws, request);
});
} else if (pathname === '/b') {
namespaceB.wss.handleUpgrade(request, socket, head, function done(ws: any) {
namespaceB.wss.emit('connection', ws, request);
});
} else {
socket.destroy();
}
});
server.listen(10001, '0.0.0.0', 1024, () => {
console.log(`Listening for connections on 10001...`);
});
That's it for the server!
Once you have started the server, you can start firing away messages to the implemented endpoints. Provided the example code above, we have two endpoints:
Once you have connected to the endpoint with the SimpleMessageHandler you have to adhere to the defined message format:
Valid remote procedure calls for the SimpleMessageHandler
Positional parameters:
{
"method": "sum",
"params": [1, 2]
}
Named parameters:
{
"method": "sum",
"params": { "b": 2, "a": 1 }
}
Omitted parameters:
{
"method": "doSomething"
}
Currently, the WebSocketServer offers the following functionality out of the box:
All protected functions can be overridden for your specific namespaces. You are encouraged to override the 'onConnection' handler with handlers for the possible ws events (e. g. error) like so:
import WebSocket from 'ws';
import { MessageHandler, WebSocketServer, register, param } from 'rpc-websocketserver';
// inherit from WebSocketServer
class NamespaceA extends WebSocketServer {
constructor(messageHandler: MessageHandler, options: WebSocket.ServerOptions) {
super(messageHandler, options);
}
@register()
sum(@param('a') a: number, @param('b') b: number) {
return a + b;
}
// overriding the onConnection handler to add more event listeners once a connection is established
protected _onConnection(ws: WebSocket): void {
super._onConnection(ws);
ws.addListener('error', (err: Error) => console.log(err));
}
}
This inheritance based approach should facilitate your own implementation for custom error/message handling, logging, clean up functionality on close events and so on.
Feel free to give feedback through issues or open pull requests with improvements.
FAQs
Simple rpc websocket server, wrapping the very popular 'ws' library. Register your RPCs with convenient decorators.
We found that rpc-websocketserver demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.