0

I've been looking into the security risks that needed to be addressed when setting up an application using websockets, but the major issues I've looked at (CSRF, XSS, cross-site websocket hijacking) all seem to hinge on the websocket client being set up in a browser. Csrf and web-socket hijacking both seem to hinge on other websites being able to access cookie information from the targeted website, but this shouldn't be an issue when the websocket client is a separate, non-browser application. As for XSS vulnerabilities, I don't know how a non-browser client introduces any new issues.

Can any of these issues be ignored when building a websocket application that works outside browsers? Are there any new risks that arise when only using websockets to communicate with non-browser clients?

  • issues with html pages are not related to WS at all, what issues concern you? – dandavis Jul 6 '17 at 18:42
  • I'm planning out an application that uses WSS to connect a central server to multiple non-browser client applications on different machines. I want to know if there are any websocket-related security risks to account for concerning authenticating/authorizing a connection and securing instructions sent from the central server to a client. Since my websocket client would be a non-browser application, that seems to eliminate a lot of the common websocket vulnerabilities I've read about. – Copernicus Jul 6 '17 at 19:01
  • it also means your clients don't have to play by the rules, but you should have assumed that. there's no flaws with transports these days, it's all host environments. use wss and best practice and things will work well. – dandavis Jul 6 '17 at 19:09
0

Can any of these issues be ignored when building a websocket application that works outside browsers?

Your usage of websocket communication in a non "sandboxed browser" setting means that you don't need to worry about the shortcomings of browsers, but you are now in more control of where the data coming up/down the websocket connection is going, and also what the user is able to do with that data. This makes you vulnerable to the same variety of exploits that any TCP or HTTP connection are susceptible to. In summary, the application you are using the websocket protocol under doesn't effect the security of the protocol itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.