MQTT消息实现

Security Traps

• - Default Mosquitto allows anonymous connections — bots scan constantly, always configure auth
• TLS mandatory for external access — credentials travel plaintext otherwise
• Duplicate client IDs cause connection fights — both clients repeatedly disconnect each other
• ACLs should restrict topic access — one compromised device shouldn't read all topics

QoS Misunderstandings

• - Effective QoS is minimum of publisher and subscriber — broker downgrades if subscriber requests lower
• QoS 1 may duplicate messages — handlers must be idempotent
• QoS 2 has significant overhead — only use for commands where duplicates cause problems
• QoS applies per-message — can mix within same topic

Topic Design Pitfalls

• - Starting with / creates empty first level — home/temp not INLINECODE2
• Wildcards only work in subscriptions — can't publish to INLINECODE3
• INLINECODE4 matches everything including nested — home/# gets INLINECODE6
• Some brokers limit topic depth — check before designing deep hierarchies

Connection Management

• - Clean session false preserves subscriptions — messages queue while disconnected, can surprise
• Keep-alive too long = delayed dead client detection — 60s is reasonable default
• Reconnection logic is client responsibility — most libraries don't auto-reconnect by default
• Will message only fires on unexpected disconnect — clean disconnect doesn't trigger it

Retained Message Traps

• - Retained messages persist until explicitly cleared — old data confuses new subscribers
• Clear retained with empty message + retain flag — not obvious from docs
• Birth/will pattern: publish "online" retained on connect, will publishes "offline"

Mosquitto Specifics

• - persistence true survives restarts — without it, retained messages and subscriptions lost
• INLINECODE8 prevents memory exhaustion — one slow subscriber shouldn't crash broker
• INLINECODE9 binds all interfaces — use 127.0.0.1 for local-only

Debugging

• - Subscribe to # sees all traffic — never in production, leaks everything
• INLINECODE12 exposes broker metrics — client count, bytes, subscriptions
• Retained messages persist after fixing issues — explicitly clear them
• INLINECODE13 shows topic with message — essential for debugging