WebSocket Development

We design the WebSocket server layer for your specific connection volume, message frequency, and payload characteristics. Framework selection: Socket.IO where its room abstraction and automatic reconnection simplify the feature set; the raw ws library where Socket.IO's overhead is unnecessary for high-frequency data feeds; uWebSockets.js for applications requiring maximum throughput at tens of thousands of concurrent connections. Process architecture: single-process Node.js for applications below 10,000 concurrent connections; Node.js cluster or PM2 cluster mode for multi-core utilisation beyond that; separate WebSocket process pool behind an Application Load Balancer for traffic-isolated scaling. Connection lifecycle management: upgrade handler validates the incoming HTTP request before allowing the WebSocket upgrade, stores authenticated session state on connection, and cleans up all associated subscriptions on disconnect to prevent memory leaks under high connection churn. Heartbeat and keepalive: ping/pong frames at configurable intervals to detect silently disconnected clients, the connections that stop responding without sending a close frame, which accumulate as phantom connections without explicit keepalive detection.

Full chat implementations built on WebSocket for the low-latency delivery that makes messaging feel instantaneous. Private 1-1 messaging and group channels: each channel maps to a WebSocket room; messages published to the room are delivered to all connected members in under 100ms on a properly architected server. Message persistence: every message written to PostgreSQL before the WebSocket delivery event is sent, so a user who connects after the message is sent retrieves it from the database rather than losing it. Read receipts using message acknowledgement events: the client sends a delivered event when a message is displayed, updating the sender's UI from "sent" to "delivered" in real time. Typing indicators via ephemeral WebSocket events, not stored, just broadcast to room members and cleared after 3 seconds of inactivity. Offline message delivery: messages sent while the recipient is disconnected are queued and delivered on reconnection. Front-end state management using Zustand with optimistic updates, the message appears in the UI immediately on send, then confirmed or rolled back based on the server acknowledgement.

WebSocket connections to external data sources, financial market feeds, IoT sensor streams, third-party event APIs, normalised and forwarded to your front-end clients at scale. Single upstream WebSocket connection to the data source with server-side fan-out to all subscribed clients: one upstream message consumed once, delivered to 10,000 clients without making 10,000 upstream API calls. Kafka or Redis Streams as the intermediate buffer for high-frequency feeds: the upstream feed writes to the stream; WebSocket server instances consume from the stream and deliver to their connected clients without needing to coordinate directly with each other. Schema normalisation at the ingestion layer: external data sources emit inconsistent message formats, we normalise to a typed internal schema before fan-out so the client implementation is stable even if the upstream changes its format. Backpressure handling for slow clients: the server tracks per-connection queue depth and applies backpressure when a client falls behind rather than buffering unboundedly in memory. Connection recovery with automatic reconnection to the upstream and catch-up delivery from the buffer for any events missed during the interruption.

Token-based authentication on the WebSocket handshake, implemented correctly, not as an afterthought. The insecure pattern: passing JWT tokens as URL query parameters (visible in access logs, cached by proxies). The correct pattern: the client requests a short-lived single-use token via a standard authenticated HTTP endpoint, passes it in the WebSocket upgrade request's Sec-WebSocket-Protocol header or as a message on connection, and the server validates it before the connection is established. Token expiry handling: the server tracks token expiry for each connection and disconnects gracefully when the session expires, prompting the client to re-authenticate and reconnect. Permission changes mid-session: when a user's permissions change (role downgrade, account suspension), the server forces disconnection so the updated permission set is applied on reconnect rather than persisting stale permissions for active connections. Channel-level authorisation: connection establishment validates identity; subscription to a specific channel validates that the authenticated user has permission to receive that channel's events. Origin validation on the WebSocket upgrade to prevent cross-site WebSocket hijacking.

Horizontal scaling architecture so your WebSocket layer handles traffic growth without requiring a single large server. The fundamental problem: WebSocket connections are stateful, a client is permanently connected to one specific server process. When a message needs to reach a client on a different server node, the originating node must be able to reach it. Redis Pub/Sub solves this: when server A receives a message for channel X, it publishes to Redis channel X; every server node subscribed to channel X delivers the message to its connected clients subscribed to X. Channel topology design: fine-grained channels (one per conversation, one per resource) reduce unnecessary message delivery; coarse channels (one per user) simplify subscription management; the right balance depends on your event volume and client subscription pattern. Load balancer configuration: AWS ALB or Nginx with sticky sessions (IP hash or session cookie) to route a reconnecting client back to the same server node where its session state is cached, or stateless session design using Redis for session state so any node can handle any connection without affinity. Load-tested under your peak concurrent connection target with gradual ramp-up to identify the failure mode before it occurs in production.

Client-side reconnection logic that handles the network conditions real users experience: brief mobile network drops, WiFi to cellular transitions, and sleep/wake cycles on laptops. Exponential backoff with jitter: the first reconnection attempt after 1 second, doubling up to a 30-second cap with randomised jitter to prevent reconnection storms when a server restarts and thousands of clients reconnect simultaneously. Message sequencing with client-side sequence numbers: the client sends its last received sequence number on reconnection; the server delivers any messages with higher sequence numbers from the buffer, ensuring no events are lost during the reconnection window. Server-side buffer size configurable per channel type, high-frequency feeds buffer fewer messages to prevent memory pressure; important state change events buffered for longer to guarantee delivery. Circuit breaker for repeated reconnection failures: after 10 failed attempts, the client stops reconnecting and displays a degraded state UI rather than exhausting mobile battery on a server that is genuinely down. Monitoring: active connection count, connection establishment rate, and disconnection reason breakdown (client close, server close, network drop) tracked in your observability stack for SLA visibility.