0

According to my understanding there is upgrade to the WebSocket protocol during the WebSocket handshake.

We use HTTPS connections (we do not use HTTP).

Should we configure the WebSocket protocol in a firewall between a browser and a server? Or enough to allow only HTTPS between a browser and a server?

There are some libraries (e.g SockJS) that performs a WebSocket emulation. Is it enough to allow only HTTPS in a firewall between a browser and a server?

Updated Last, but not least: in all cases we need to protect our application against WebSocket attacks at the application level (not via firewall):

  • DDOS attacks
  • CSRF protection
  • Authentication
  • Authorization
  • ...

Correct?

1

Should we configure the WebSocket protocol in a firewall between a browser and a server?

Can you? It is unclear what specific capabilities your firewall has so it is unknown if you can do any special filtering for the WebSocket protocol at all. If your firewall offers the possibility and there is only WebSocket to expect, then why not restrict it to what you expect.

Or enough to allow only HTTPS between a browser and a server?

Again, nothing is known about your firewall can do in the first place so no recommendations can be done here.

There are some libraries (e.g SockJS) that performs a WebSocket emulation. Is it enough to allow only HTTPS in a firewall between a browser and a server?

SockJS is just HTTP(S). So exactly this should be allowed.

Last, but not least: in all cases we need to protect our application against WebSocket attacks as described in many threads here.

I'm not sure which attacks you refer to since "described in many threads" does not really point out specific attacks. But very likely a generic firewall will not protect against attacks specific to WebSockets.

4
  • Thanks! I have updated the question. – Michael Nov 4 '20 at 8:44
  • @Michael: DDoS is not specific to WebSockets, There is no CSRF for Websockets, only CSWSH - and a generic firewall will not protect against this. "Authentication" and "Authorization" are neither attacks nor vulnerabilities by themselves and a firewall will not generically protect against arbitrary vulnerabilities in this area in your application. – Steffen Ullrich Nov 4 '20 at 8:52
  • I know that I will not be able to protect against application attacks via firewalls. My assumption since we are going to use WebSocket we need to protect our application for specific WebSocket attacks. E.g. CSWSH or other. Is my assumption correct? – Michael Nov 4 '20 at 8:59
  • @Michael: CSWSH is a vulnerabilty which should better be fixed in the application itself. Again, a generic firewall will not protect you here. There is nothing known about the capabilities of what you use except a generic, unspecific and broad "firewall". – Steffen Ullrich Nov 4 '20 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.