4

I was reading a post about tcp sockets in the browser here and one of the mentioned reasons for not allowing it is that allowing websites to open TCP sockets would be a security risk but doesn't detail what this risk would be.

What kinds of security issues would be opened up by allowing websites to open TCP sockets and how are they not applicable to websockets?

Improve this question
2

1 Answer 1

Reset to default
6

Allowing arbitrary TCP sockets originating from the web browser means that an attacker can use the browser as a trampoline to connect to arbitrary services on the users local network. This can for example be local mail servers which often are setup to trust any internal system to send mail and thus can be misused to send phishing mails which look like they came from a local system or simply to send spam. But also other services could be affected.

WebSockets instead are an application layer protocol on top of TCP. They start with a HTTP based challenge-response and continue with a protocol using frames which are additionally xor'ed with some previously established random key. This is specifically done so that this protocol can not be misinterpreted by unsuspecting TCP servers.

how are they not applicable to websockets?

While it is true that WebSockets are considered much less dangerous than plain TCP they are not innocent. If there is an internal application which can be accessed using WebSockets explicite measures must be taken at the server side to restrict access to this application. WebSockets are not covered by the same-origin policy in the browser, i.e. it is possible to cross-origin connect to a WebSocket server and any restrictions to this need to be employed at the server side. See also Cross-Site WebSocket Hijacking (CSWSH).

Improve this answer
3
  • Would allowing raw sockets allow for JS to connect to localhost and bypass the computers own firewall?
    – Qwertie
    Commented Jan 30, 2018 at 5:50
  • how would opening a socket on the browser's PC allow a mail server compromise? an open socket is a way to receive requests, not make them, right?
    – dandavis
    Commented Jan 30, 2018 at 8:14
  • @dandavis: given that you compare using TCP sockets and WebSockets inside a browser I was under the impression that you ask about connecting from the browser to some other host (since this is what you do with WebSockets) and not listening for incoming connections on the browser. Also, the post you refer to also asks about establishing connections from the browser and not to the browser, i.e. connecting and not listening. Apart from that - what would you do with such a listening socket anyway since it will be in most cases not reachable from outside anyway due to firewalls or NAT.
    – Steffen Ullrich
    Commented Jan 30, 2018 at 8:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .