According to my understanding there is upgrade to the WebSocket protocol during the WebSocket handshake.
We use HTTPS connections (we do not use HTTP).
Should we configure the WebSocket protocol in a firewall between a browser and a server? Or enough to allow only HTTPS between a browser and a server?
There are some libraries (e.g SockJS) that performs a WebSocket emulation. Is it enough to allow only HTTPS in a firewall between a browser and a server?
Updated Last, but not least: in all cases we need to protect our application against WebSocket attacks at the application level (not via firewall):
- DDOS attacks
- CSRF protection