WebSocket Security Issues
Overview
WebSocket connections bypass same-origin policy — browsers send cookies with WebSocket upgrade requests, making them vulnerable to:
- Cross-Site WebSocket Hijacking (CSWSH): No
Originheader validation allows cross-origin connections - Missing authentication: WebSocket handlers that don't verify the user is logged in
- Message injection: User-controlled messages echoed back without sanitization
Detection Strategy
- WebSocket
upgradehandlers that don't verify theOriginheader - WebSocket handlers that don't check session/token before processing messages
- Message data broadcast directly without sanitization
Remediation
- Validate
Originheader against an allowlist - Require valid session/JWT before accepting WebSocket connection
- Sanitize all messages before broadcasting