Hi, I am using Ktor websocket server with Netty engine, is there a way to not send data in the ping/pong frames? By default its sending garbage as payload

You can disable pings by setting the interval to null https://ktor.io/docs/websocket.html#configure The default pinger is performing as expected for the ping concept. https://github.com/ktorio/ktor/blob/main/ktor-http/ktor-http-cio/jvm/src/io/ktor/http/cio/websocket/PingPong.kt#L94 It is validating the echoed response is equal to the input.

Well, is there a way to make that random string a constant?

In the current implementation, no. I am unsure ho viable it is to disable it via config and implement your own pinger though

Well, if you look at it in cyber security perspective, it's a vulnerability to allow 150 bytes of raw data to be transfered on the protocol, and because its random bytes you cannot filter it with json schema for example

I am curious why it would be a vulnerability?