• RSA upgraded from 512 to 2048 bits
• AES-256 via Fernet for symmetric traffic
• Per-client symmetric keys to avoid data leakage across users

• UUID v4 tokens with configurable expiration
• Default time to live: 24 hours
• Manual revocation endpoint
• Automatic cleanup of expired tokens
• Optional IP validation

• Full support for secure WebSockets
• SSL certificate configuration flags on the server
• Automatic ws:// vs wss:// detection on the client
• Certificate verification on the client

• 10 KB limit per outbound message
• 1 MB limit for inbound payloads
• Payload size validation before processing
• Oversized messages are rejected

• Targeted try/except blocks for crypto operations
• 10 second timeout for network calls
• Clear error messages without leaking internals
• Validation of empty or malformed responses

• ast.literal_eval replaced by json.loads / json.dumps
• Eliminates code injection risk
• Faster and standardized serialization
• Universally supported format

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

python cmd_chat.py serve 0.0.0.0 1000 \
  --password "MySecurePassword123!" \
  --ssl-cert cert.pem \
  --ssl-key key.pem

# Step 1: generate a token
curl -X POST https://your-server.com:1000/generate_token \
  -d "admin_password=MySecurePassword123!" \
  -d "username=alice" \
  -d "ttl=3600"  # seconds

# Step 2: connect using the token
python cmd_chat.py connect your-server.com 1000 alice \
  --token "550e8400-e29b-41d4-a716-446655440000" \
  --ssl

curl https://your-server.com:1000/health

Expected response:

{
  "status": "healthy",
  "active_users": 5,
  "messages_count": 142,
  "active_tokens": 8
}

For production-grade security:

1. Add IP based rate limiting
2. Implement heartbeat or ping/pong
3. Produce audit logs for critical events (no sensitive payloads)
4. Configure CORS rules for the REST API
5. Enforce firewall rules per IP range
6. Use Let's Encrypt or another trusted CA for SSL

• Use SSL/TLS in production (WSS)
• Generate tokens with short TTL (1 to 24 hours)
• Revoke unused or leaked tokens
• Require strong admin passwords (16+ chars)
• Monitor /health regularly
• Restrict network access via firewall rules

• Expose passwords or tokens in source control
• Use self-signed certificates in production
• Share tokens publicly
• Disable SSL verification (verify=False)
• Use RSA shorter than 2048 bits
• Log decrypted chat payloads

Copy .env.example to .env and set:

SERVER_HOST=0.0.0.0
SERVER_PORT=1000
ADMIN_PASSWORD=your_secure_password_here
SSL_CERT_PATH=/path/to/cert.pem
SSL_KEY_PATH=/path/to/key.pem
TOKEN_TTL=86400

Full documentation: README.MD
Roadmap: ROADMAP.md