Skip to content

fix(ocpp-wamp): refuse a websocket upgrade outside the endpoint path - #145

Open
juherr wants to merge 1 commit into
IZIVIA:devfrom
juherr:juherr/ocpp-toolkit-issue-133
Open

juherr wants to merge 1 commit into
IZIVIA:devfrom
juherr:juherr/ocpp-toolkit-issue-133

Conversation

@juherr

@juherr juherr commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

OcppWsEndpoint.extractChargingStationOcppId now returns null unless the URL matches /<path>/{id} exactly (or the id cannot be decoded), so a WebSocket upgrade outside the endpoint is refused with a 4xx instead of a 500, and a second WebSocket path on the same port (/ws20/OK next to ws16) connects again (500 → 101).

Behaviour change: URLs that only contain the endpoint, such as /ws/OK/extra or /ocpp/ws/OK (a proxy adding a prefix), used to connect as station OK (101) and are now refused (400); a trailing slash and a double slash are still accepted.

Tests: unit cases in OcppWsEndPointTest plus a toolkit WebsocketEndpointPathTest covering two paths on one port and a single path; they assert a 4xx rather than a fixed code because a refused upgrade answers 400 on dev and 404 once #134 is merged, after which /ws16/REFUSED on a two-path port is expected to answer 404 (not covered here).

Closes #133

UriTemplate.extract searches the template anywhere in the uri and
throws when it is not there. A url outside the endpoint made the
upgrade predicate throw and Undertow answer 500: on a port carrying
two websocket paths, every station on the second one was refused
this way. A url that only contained the endpoint, such as
/ws/OK/extra or /ocpp/ws/OK, was accepted as the station OK.

extractChargingStationOcppId now returns null unless the uri matches
the template exactly, and when the id cannot be decoded. The upgrade
is then refused as a client error. A trailing slash and a double
slash are still accepted.

Closes IZIVIA#133
@sonarqubecloud

sonarqubecloud Bot commented Nov 8, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(ocpp-wamp): do not answer 500 to a WebSocket upgrade on a URL outside the endpoint

1 participant