How Open Chat Works

When you visit Open Chat and choose a display alias, the server provisions an anonymous ephemeral session stored securely in an HttpOnly, SameSite=Lax session cookie. No email addresses, telephone numbers, passwords, or social OAuth connections are ever requested, processed, or stored.

Upon session creation, your client establishes a persistent full-duplex WebSocket connection to the backend. Each client socket is managed by an isolated writer goroutine with a bounded buffer, ensuring high throughput, minimal memory overhead, and instant message broadcast.

Every message passes a strict pipeline before reaching any user: Receive → Authenticate Session → Authorize Room Membership → Validate Schema & Rate Limit → Persist to PostgreSQL with idempotency keys → Audit Log → Broadcast to conversation participants.

Attachments undergo strict server-side validation: magic byte verification, complete memory raster decoding, EXIF metadata stripping, dimension clamping (≤ 4096px), and SHA-256 integrity hashing. Malicious vector formats (like SVGs) are blocked.