0

Is it secure to send messages between a WebSocket Server and the Client?

An example of sending messages between a (Socket.io) server, is in Node.js:

socket.on("myMessage", function(msg) {
// "msg" is the message being sent
});

Could a user get / change the client-side JavaScript code, and send some kind of bad message to the server? (e.g., SQL injection)

What are the ways of preventing that?

Another example of using PubNub's API for client side chat apps, that does not use a server:

pubnub.addListener({
  message: function(msg) {
    // "msg" is the message being sent
  }
});

1 Answer 1

5

Could a user get / change the client-side JavaScript code, and send some kind of bad message to the server? (e.g., SQL injection)

Given that in almost all cases the server has no sufficient control over the client, it is practically never safe to blindly trust that the client will only send the expected data. This is true for "normal" HTTP requests, API calls, WebSockets, mail, instant messaging ...

What are the ways of preventing that?

Always rigorously verify user input before using it a potentially dangerous way. Also use techniques which prevent injection attacks by design, like parameter binding instead of constructing SQL instructions using string concatenation with untrusted user input.

2
  • Like checking the data in the server, to see if it's expected? Commented Nov 14, 2021 at 15:48
  • 2
    @ParkingMaster: Correct: check that the received data match the expectation, i.e. have the relevant type (i.e. number vs. arbitrary string), are expected in the specific context, ... . Also don't assume that an authenticated client can only send "proper" data. Commented Nov 14, 2021 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .