0

until recently, I've been embedding a chatbot service from a different/external site with an iframe tag.

it's a paid service, not a free one.

today I saw that they changed a few urls, swithing from "https://" to "wss://"

I have concerns about the "wss" protocol when it comes to the security of my site visitors.

I've read about the "wss" protocol but can't conclude if it's less secure for my site visitors.

does it have more potential to hurt of my site visitors? does it have any security dangers that the previous ("https") one did not have?

Improve this question
2
  • Are you sure that they asked you exactly this? Because this would not work in my understanding: The src argument for an iframe expects a document to render, i.e. it will issue a single request for the URL and get a single response back which then gets rendered in the iframe. WebSocksts (ws, wss) does not provide this kind of semantics though, i.e. there is nothing to render here.
    – Steffen Ullrich
    Jun 19 at 6:11
  • sorry, I see now it's the same embed code, but the urls in various places was switched from "https" to "wss". (I edited the post). the question remains: does wss have any additional security issues compared to the https protocol? maybe because it goes both ways, from client to server as well
    – rami300
    Jun 19 at 13:02

1 Answer 1

Reset to default
0

WSS is just WebSockets (WS) over TLS, similar how HTTPS is just HTTP over TLS. Using WS or WSS by itself does neither introduce new risks to the client side, nor does it add additional protection.

Of course, a site is not just switching from HTTPS to WSS by simply changing the URLs in the code but it must also change the code around these URLs. New vulnerabilities might be added this way but this is not specific to the use of WSS vs. HTTPS.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.