fix(rpc): gracefully reject invalid ws upgrades to prevent ECONNRESET

Author: antfubot

packages/devframe/src/rpc/transports/ws-server.ts

@@ -157,19 +157,27 @@ function routeUpgrades(
   allowedOrigins: readonly string[] | false | undefined,
 ): () => void {
   const listener = (req: IncomingMessage, socket: Duplex, head: Buffer) => {
+    socket.on('error', () => {
+      // Prevent unhandled ECONNRESET crashes when destroying the socket
+      // or when the client abruptly disconnects.
+    })
+
     if (path) {
       let pathname = req.url ?? '/'
       try {
         pathname = new URL(req.url ?? '/', 'http://localhost').pathname
       }
       catch {}
       if (!pathMatches(pathname, path)) {
-        if (destroyUnmatched)
+        if (destroyUnmatched) {
+          socket.write('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n')
           socket.destroy()
+        }
         return
       }
     }
     if (allowedOrigins !== false && !isAllowedOrigin(req.headers.origin, allowedOrigins ?? [])) {
+      socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n')
       socket.destroy()
       return
     }

packages/devframe/src/rpc/transports/ws.test.ts

@@ -187,6 +187,7 @@ describe('ws origin check', () => {
       })
       ws.on('error', () => resolve('closed'))
       ws.on('unexpected-response', () => resolve('closed'))
+      ws.on('close', () => resolve('closed'))
     })
   }