Reading the Web Socket RFC, at 5.1 it says:

a client MUST mask all frames that it sends to the server (see Section 5.3 for further details). (Note that masking is done whether or not the WebSocket Protocol is running over TLS.) The server MUST close the connection upon receiving a frame that is not masked

but what's the purpose of such mask? If using Wireshark I'm reading the message the client sent without any problem?

  • If you're using Wireshark from the client or server end, I think you're reading them before they're sent/after they're received - so they're already unmasked at that point. – Philip Rowlands Feb 10 '16 at 13:19
  • @SteffenUllrich that's a different thing. That's for setting the communication, basically a typical exchange of a hashed secret. However, the MASK is, in theory as I understand, for not showing the data in plain text, but it's there in the wire. – Ay0 Feb 10 '16 at 14:47
  • @yzT - you are right, the mask is per frame not per connection – Steffen Ullrich Feb 10 '16 at 15:09

The reason for the masking is to make websocket traffic look unlike normal HTTP traffic and become completely unpredictable. Otherwise any network infrastructure equipment which is not yet upgraded to understand the Websocket protocol can mistake it for normal http traffic causing various problems.

This is especially a problem for caching proxy servers and leads to possible attack scenarios. Specifically crafted websocket traffic can cause cache poisoning by tricking the proxy servers into mistaking a part of a websocket communication for a request and response for an unrelated URL, cache it like a legitimate response and send it to other users which request that URL.

  • just read all the caching proxy stuff (RFC 10.3), and seems you're right. The misunderstanding here I think is what Philip Rowlands said in the comment, because I noticed that in the data stream there is no message in plain text, but if I click on line-based text data (2.x) or unmask payload(1.x) section, the message is shown in an additional tab. – Ay0 Feb 10 '16 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.