The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
3answers
152 views

Socket.IO Client Security

I am new to Node.js and Socket.IO. According to documentation the client side code is something like: <script src="/socket.io/socket.io.js"></script> <script> var socket = ...
0
votes
0answers
276 views

Socket.IO & WebSocket security - query certifcate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
2
votes
1answer
236 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
4
votes
2answers
1k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
3
votes
2answers
1k views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...
-2
votes
2answers
495 views

Why don't we have any popular decentralized chat systems, social networks etc.? [closed]

Let's say two computers have the same decentralized chat program. Each user has to have an ip address and port number to send the message to another person. Each message is encrypted using, let's say, ...
0
votes
2answers
381 views

How do I securely identify a remote (self programmed embedded) device in PHP?

Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)? Background: I have several embedded devices (self programmed & adaptable) that contact ...
4
votes
2answers
869 views

Is it possible to create a secure chat web application relying on HTML5 web sockets?

Is it possible to create a secure chat web application using just HTML5 and Javascript? What possible security holes would there be if the server doesn't store the messages, just relay them using ...
4
votes
2answers
728 views

How does websocket frame masking protect against cache poisoning?

I've been studying the Websocket protocol (RFC 6455). Section 10.3 specifically talks about frame masking, which is prevents cache poisoning from http proxy servers. How does frame masking prevent ...
3
votes
1answer
345 views

Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
0
votes
1answer
3k views

Websocket implication for firewalls

(I've read several questions here about websocket but apparently there's no websocket tag) If I understand correctly websockets are using TCP trafic over port 80. What are the implication, if any, ...