1

Websockets don't support sending auth tokens during websocket handshake as part of HTTP headers, rather only via query parameters. This has a security risk of leaking these tokens in server logs. However, if we create these JWT tokens with very short expiry and a nonce/jti and make it a one-time token, does it mitigate the risk? Anything I am missing or needs to be considered from a security perspective?

Other way of doing auth in websocket is to send the auth tokens as the first message after creating a websocket connection, but that also introduces risk of unauthenticated users creating server connections leading to potential DoS.

1 Answer 1

1

If you control both the client and server of the websocket it's not clear why you'd use JWTs + nonces when you could just use single-use random tokens instead, but if you don't control the server then this might make sense.

Single-use tokens in URLs are generally considered acceptable, although ideally you want to avoid them if possible. Another option would be cookies; you can't set custom headers for websocket handshakes, but cookies still get sent (subject to normal restrictions like the Secure and SameSite and Domain attributes). Cookies do open you to risk of cross-site attacks on your websocket server, but this can be mitigated by checking the Origin header on the server and only allowing trusted origins (you can also set SameSite on the cookie, but this is a significantly weaker protection).

Finally, I'm not actually sure that opening a WS and then waiting for an auth message is that much more expensive than doing auth with the WS handshake. It depends somewhat on how the server is implemented, but fundamentally, I don't see any reason that opening a WS should be more expensive than opening an HTTP connection, and servers already deal with clients doing that all day long (and need to have mitigations for malicious attempts to do the same, such as opening the connection and then doling out the request at a very slow rate, like single-digit bytes per minute slow, in an attempt to achieve resource exhaustion on the server).

1
  • Thanks, the response was indeed very helpful, I will look at the other pointers, meanwhile with respect to the last pointer, you mean the problem of unauthenticated connections on server is not really a very big problem, as servers deal with them all the time ? Did I understand you correctly? Commented Mar 29 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .