---
title: "Limit the connections and messages of each · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/live-connections/connection-limits
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Limit the connections and messages of each client

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Live connections](https://agentwranglers.se/playbook/api-design/live-connections.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: API-73
- Level: Required
- Chapter: [Live connections](https://agentwranglers.se/playbook/api-design/live-connections)
- Rule: Limit how many connections each account may hold open, how large one message may be and how many messages it may send per minute. Close or refuse the rest.
- Risk: The app down or unusable
- How: One script can open thousands of sockets or send one huge message, and every open socket holds memory. Start with 10 connections per account, 64 KB per message and 100 messages a minute. Count by address only when nobody is signed in. Set the size cap in the WebSocket library, so it stops reading before the message is built in memory. Refuse an extra connection with 429 during the handshake, and close a socket that sends too much with code 1008 or 1009. Caps on ordinary requests are in [cap the size of every request and answer](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/resource-limits). Request rates are in [limit requests per client](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/limit-requests).
- Check: From one test account, open 11 connections, send a 65 KB message and send 101 messages in a minute. The 11th connection gets 429, and the large message and the 101st message close the socket.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { WebSocketServer } from 'ws';

const MAX_MESSAGE_BYTES = 64 * 1024;
const MAX_CONNECTIONS_PER_ACCOUNT = 10;

const server = new WebSocketServer({ noServer: true, maxPayload: MAX_MESSAGE_BYTES });

httpServer.on('upgrade', (request, socket, head) => {
  const account = accountFrom(request);
  if (openCount(account) >= MAX_CONNECTIONS_PER_ACCOUNT) {
    socket.end('HTTP/1.1 429 Too Many Requests\r\nRetry-After: 30\r\n\r\n');
    return;
  }
  server.handleUpgrade(request, socket, head, ws => server.emit('connection', ws, request));
});
```

### Python example

```python
import websockets

MAX_MESSAGE_BYTES = 64 * 1024

async def main():
    async with websockets.serve(handle_socket, "0.0.0.0", 8080, max_size=MAX_MESSAGE_BYTES) as server:
        await server.serve_forever()
```

## Sources

- [RFC 6455 section 10.4 Implementation-specific limits](https://www.rfc-editor.org/rfc/rfc6455#section-10.4)
- [OWASP WebSocket Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/WebSocket_Security_Cheat_Sheet.html)

## Related rules

- [Cap the size of every request and answer](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/resource-limits) in Security testing
- [Limit requests per client](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/limit-requests) in Security testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/api-design/live-connections/connection-limits">Agent Wranglers API design playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Reconnect with backoff and resume from the last event](https://agentwranglers.se/playbook/api-design/live-connections/reconnect-and-resume)
- Next: [Deliver events through a shared channel](https://agentwranglers.se/playbook/api-design/live-connections/shared-pubsub)
- [Live connections](https://agentwranglers.se/playbook/api-design/live-connections)