Project that I'm working on depends on WebSockets to communicate between the server and client browser for all interactions within the game. I'm attending university for Computer Security, but I'm still unsure about potential attacks against the current validation system.
I'll start off real quick and say that at this current time I cannot use Secure WebSockets due to Autobahn (still ) not supporting Secure WebSockets. If I have to change my framework that I'm using to solve any problems I will though.
As it works right now, on connecting the user requests the server's public key (2048 bits) which can be changed at a regular interval, server gives the public key to user. To validate the key a quick exchange of sending a constant known string encrypted with the key is sent to the server and the server verifies the key is correct to the user. After verifying the key, the client encrypts the plain-text password provided by the user and sends it to the server. Server decrypts password, hashes password with bcrypt and validates the password in a timing-attack resistant way (No early out, nearly constant runtime). Encryption uses a randomized nonce as a part of the padding to prevent replay-attacks.
The part I'm most suspect about is how my current implementation "tracks" which socket belongs to who. Basically if a "login" request is handled by a socket and the result is positive then the socket gets "named" by setting a special attribute on the socket to the username provided in the login request.
On disconnection the socket is destroyed and there are staleness checks for sockets that haven't received a request in a long time to be automatically logged out. The only way to set the attribute on a socket server-side is to perform a successful login request.
I'm aware of the MITM attack possibility regarding the key exchange.
My concerns are what are the flaws in this system, and how should I prevent or mitigate them?