Repository navigation
fix: suppress WebSocket handshakes from network list - #93
Merged
Merged
Conversation
…blic API - coalesce notifyListeners via frame-aligned post-frame instead of per-change Timer - MemoryViewer high-frequency cards now refresh via liveNotifier (no full rebuild) - WebSocket detection uses Upgrade header, not just /ws path (avoids token leak) - HttpOverrides now chains host overrides instead of replacing them - memoize network/log filter results - add global body memory budget (default 16MB) with accounting on eviction - Dio concurrent same-URL responses match the longest-pending request - mount only the active panel tab; warn on route-injection fallback - export more public capabilities (memory/alert services, models, viewers) - bump version 1.7.1 -> 1.7.2
…etwork list - detect WS via URL scheme (ws/wss) at openUrl time; the Upgrade header is only set by WebSocket.connect AFTER openUrl resolves, so the old header check always returned false and handshakes like wss://echo.websocket.events were logged as normal GET requests, surfacing failed handshakes as 'OS Error status -1' in the network list. - add an FPS animation toggle to the example app to stress-test FPS (an idle app shows single-digit FPS because no frames are produced). - document the dart format . step in the AGENTS.md local-verify checklist.
- add a changelog-scope rule to AGENTS.md: doc/example-only changes are not changelog-worthy; a pure version-bump commit is the allowed exception. - correct the 1.7.2 WebSocket entry to describe URL-scheme-based detection.
… flag - InspectorWebSocket.connect now wraps WebSocket.connect in a runZoned with wsHandshakeZoneKey; the HttpOverrides interceptor skips the raw handshake GET, so handshakes (including failed ones) no longer leak into the Network list as OS Error status -1 GETs. Captured frames still surface as WS entries when capture is enabled. - update CHANGELOG 1.7.2 to reflect the runZoned-based mechanism.
The WS capture demo previously connected to the public wss://echo.websocket.events endpoint, which is unreachable on many device networks, so the handshake failed before any WS entry was created and the inspector showed nothing (or a socket error). Bind a loopback echo server (127.0.0.1, random port) on startup and have the demo connect to it, so WS capture is verifiable fully offline. Falls back to the public echo service only if the local server fails to start.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary / 摘要
Stop WebSocket upgrade handshakes from appearing as fake HTTP GET entries in the network list, and ship related performance optimizations. / 阻止 WebSocket 握手以伪造的 HTTP GET 条目出现在网络列表中，并附带相关性能优化。
Changes / 变更
GETentries (e.g.https://echo.websocket.events:0#). / 通过 runZoned 标志抑制 WebSocket 握手进入网络列表，不再产生伪造的GET条目。WSentries with accumulated frames instead of GET requests. / 正确归类 WebSocket 握手，以WS条目（含累积帧）呈现，而非 GET 请求。lib/changes and fix WS entry wording. / 将 CHANGELOG 范围限定为lib/改动，并修正 WS 条目措辞。Context / 背景
WebSocket capture previously opened the underlying
HttpClientupgrade as a normalGETrequest, polluting the network list with a malformed entry and anOS Errorbody. This change keeps the handshake out of the list while still recording the realWSsession with its frames. / WebSocket 抓取此前会把底层HttpClient的 upgrade 当成普通GET请求，导致网络列表出现畸形条目与OS Errorbody。本次改动让握手不再进入列表，同时仍以WS会话（含帧）记录真实连接。Checklist / 检查项
Test plan
WSentry appears with frames and no bogusGETentry. / 打开检查器→Network，开启 WS 开关后发起 WebSocket，确认出现WS条目与帧，且无伪造 GET 条目。flutter analyzeandflutter test; all green. / 运行flutter analyze与flutter test，全部通过。🤖 Generated with Zero Buddy