/SecureWebSockets

Primary LanguageJavaScript

Securing WebSocket Communication

Best Practices to secure WebSockets

    Use 'wss' instead of 'ws'
  • Hard code the URL of the WebSockets endpoint
  • Do not allow user-controllable data into the WebSocket URL
  • Check origin against a whitelist: make sure the origin you are seeing is the one you expect
  • Use CSRF tokens(random tokens) for sensitive data/actions
  • Try to avoid session handling or access within the WebSocket protocol, handle it separately
  • Use rate limiting: keep track of clients' web sockets to avoid too many connection attempts by the client

Detect or exploit WebSockets

  • Manipulate websocket messages: XSS attack
  • Manipulate Websocket handshake
  • If Origin header verification is in place, check for broken verification.
  • Communication takes place on 'ws' instead of 'wss'
  • WebSocket handshake relies on HTTP cookies (session) and no CSRF tokens are used. (WebSocket hijacking via CSRF vulnerability)

Impact

  • Utilize insecure web sockets to exploit other vulnerabilities.
  • An attacker can perform unauthorized actions as victim
  • An attacker can gain access to the sensitive data
  • If the victim is an admin or a privileged user, the attacker can gain access over the entire web application

Notes:

  • Browsers don't enforce SOP for websockets, hence the Origin header verification is necessary.