README

A zero-dependency native implementation of WebSocket server in PHP.

Lightweight and minimalistic.

Features

• Strict adherence to RFC 6455
• Automatic HTTP Upgrade handshake compliant with RFC 9110 and RFC 9112
• SSL/TLS encryption support
• Binary and textual data message support, both sending and receiving
• Transparent reassembly of incoming fragmented messages
• Built-in handling for Ping, Pong, and Close control frames
• User-defined non-blocking timers
• Non-blocking I/O

Requirements

• PHP 8.4 or higher (64-bit)

Important

If you plan to run websockets on a shared hosting, note that most providers block ports for any third-party usage. A VPS or dedicated server is highly recommended.

Installation

This library may be installed via Composer:

composer require dimogrudev/php-websocket

Usage

use WebSocket\Server;
use WebSocket\Contract\ClientInterface;
use WebSocket\Contract\RequestInterface;
use WebSocket\Entity\Message;

require 'vendor/autoload.php';

// Create an instance of the server class
// 0.0.0.0 is set as host to make the server reachable at all IPv4 addresses
$server = new Server('0.0.0.0', 8443);
// Enable encryption and provide certificate files
$server->encryption(true, 'path/to/cert.crt', 'path/to/cert.key');

// Handle incoming messages
$server->onMessageReceive(function (ClientInterface $client, Message $message): void {
    if ($message->isBinary) {
        echo "{$client->ipAddr} (#{$client->id}) sends binary message ({$message->length} bytes)\n";
    } else {
        echo "{$client->ipAddr} (#{$client->id}) sends `{$message->payload}`\n";
    }
});

$server->start();

Tip

Modern browsers block non-secure WebSocket connections (ws://) on secure websites (https://). Always use a valid SSL certificate (e.g. Let's Encrypt) for production.

Timers

// Create a timer to run function repeatedly with a 500 milliseconds interval
// It provides timer ID which may be used for later cancellation
$timerId = $server->setTimer(function (): void {
    // Your logic here
}, 500, true);

// Cancel the timer
$server->clearTimer($timerId);

Callbacks Reference

Connection Security

Unauthorized connections may be rejected by using the onHandshake callback:

$server->onHandshake(function (ClientInterface $client, RequestInterface $request): bool {
    // Reject connection if it's not from your trusted domain
    if ($request->header('origin') !== 'https://example.com') {
        return false;
    }
    return true;
});

License

The MIT License (MIT). For more information, please see LICENSE.