In RFC 6455 which is the Websocket Protocol specification it says:

It is similarly intended to fail to establish a connection when data from other protocols, especially HTTP, is sent to a WebSocket server, for example, as might happen if an HTML "form" were submitted to a WebSocket server. This is primarily achieved by requiring that the server prove that it read the handshake, which it can only do if the handshake contains the appropriate parts, which can only be sent by a WebSocket client. In particular, at the time of writing of this specification, fields starting with |Sec-| cannot be set by an attacker from a web browser using only HTML and JavaScript APIs such as XMLHttpRequest [XMLHttpRequest].

I know HTML forms but, why server and client communicate with HTML forms? And what are |Sec-| fields? I'm not a web technologies professional but, I know HTML forms can be easily manipulated with HTML and Javascript APIs.

Sorry if it is too basic to ask, tell me that and I will go read relevant tutorials.

  • 1
    always link to sources
    – schroeder
    Jul 18, 2017 at 9:18
  • 1
    This is not about using HTML forms for communication. In contrary, it is about the design of the WebSocket handshake so that HTML forms or XMLHttpRequest cannot be misused to create a HTTP request which looks like the start of a WebSocket handshake. And the Sec-* are not form fields (which can be manipulated) but HTTP header fields (which cannot). Jul 18, 2017 at 9:31

1 Answer 1


As mentioned in comments section, quoted part from RFC 6455 standard under Security Model section discuss about possible code injection attacks and it's usage WebSockets as a attack vector.

For possible attack scenarios RFC 6455 specifies mitigation techniques with properly defined handshake policy. Theoretically attackers wouldn't get required interface for establishing proper connection.

Sec-* headers required for establishing and maintaining connection and mentioned mostly at fourth section Opening Handshake. They are:

  • Sec-WebSocket-Key
  • Sec-WebSocket-Extensions
  • Sec-WebSocket-Accept
  • Sec-WebSocket-Protocol
  • Sec-WebSocket-Version

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .