By default, Slash Socket accepts connections from any origin with no limits — fine for local development, but worth locking down before you point anything beyond your own machine at it. The Security panel controls three settings, all enforced server-side:
- Allowed Origins — a list of origins allowed to connect. Leave empty to allow any origin (CORS wide open, no credentials). Set one or more origins to restrict CORS to that list (credentials are then allowed).
- Max Connections — the maximum number of simultaneous clients. Defaults to 100.
- Rate Limit — new connections allowed per minute, per IP. Defaults to 60.
Security settings are read once when the server starts, so changes made in the panel take effect on the next Start, not immediately on a running server.
The dashboard also keeps a persistent IP ban list. Ban a connected client directly from the Connected Clients table, or add an IP manually from the Banned IPs panel; banned IPs are rejected on connection until you unban them.
There is no built-in authentication. The authenticate event lets a client attach a username and avatar to its connection for display purposes, but it doesn't check a password, token, or credential of any kind — treat every connected client as untrusted, and use Allowed Origins, Max Connections, and Rate Limit as your actual access controls.