I have been looking at tips to securing Websocket Connections and found this article https://portswigger.net/web-security/websockets which states that one should "
Hard code the URL of the WebSockets endpoint, and certainly don't incorporate user-controllable data into this URL."
Currently I have been taking a part of the URL using
window.location.pathname (which I'm not sure if this can be manipulated) in order to grab a name (i.e., music, movies, etc) that I then compare with entries in my DB to make sure they exist in order to continue with the connection. I have also seen similar examples doing this for reasons such as a chat room in order to keep chats for a single topic to the same ServerEndpoint. I found this page from Oracle that talks about creating this on a Java Server, to which they call it "URI Templating" https://docs.oracle.com/javaee/7/tutorial/websocket008.htm
The thing I want to know is how is one supposed to hard-code the URL if we have dynamically created data that affects the URL (again Music, Movies, etc topics that can be added). The only way I can think of now is creating a script on the html page I'm serving up that has the Websocket info hard coded when serving the page from the server, but since I'm looking to work with a WebWorker, I'm not sure if there will be some issues with that.
As a NOTE: Invalid URLs wont load the Websocket JS file/code so if I it's not a valid room (i.e., Music), there is no connection. Malicious URLs are the only way I can see something happening with this setup, and I can see why hard-coded is mentioned as the secure method; however if I'm stopping invalid URLS from loading the correct page, as well as checking to make sure the part I'm grabbing (i.e., Music), actually exists in the DB, would this be secure?
So, my question is, is what I'm currently doing not secure, by referencing the
window.location.pathname and doing the checks stated above? If it is not secure, and needs to be hard-coded, how should I go about creating a "hard-coded" Websocket URL when I have variable data that could be used as the endpoint URL? I'm also curious if a malicious URL would affect users on a case-by-case basis, or is there something deeper going on with being able to create any endpoint URL?