Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [websocket]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
102 views

Is it secure to send JWT tokens in url query parameters if we use nonce to make it a one time token?

Websockets don't support sending auth tokens during websocket handshake as part of HTTP headers, rather only via query parameters. This has a security risk of leaking these tokens in server logs. ...
Security Learner's user avatar
0 votes
0 answers
224 views

How to pentest Blazor Server apps?

I am trying to pentest a blazor server app but its very different to a traditional web app, client communicates to server via SignalR through web-sockets. The messages in web-sockets are MessagePack ...
Cyber Soldier's user avatar
0 votes
0 answers
100 views

Cache poisoning from rfc6455 (WebSockets) not requiring server message to be masked?

In RFC6455 section 10.3, it explains why they have made clients mask their outgoing frames (so that a malicious server cannot manipulate a client into sending something in plaintext, as the message ...
Secto Kia's user avatar
  • 101
4 votes
1 answer
1k views

Why is the browser not sending cookies with cross-domain WebSocket handshake request?

If I have understood Cross-Site WebSocket Hijacking (CSWSH) attack correctly [1][2][3][4], the attack relies on two things (examples are from the first reference): the browser sending the cookies set ...
sherlock's user avatar
  • 569
2 votes
2 answers
973 views

Can a client script (running within a webpage) provide to the browser a certificate to accept in a wss:// connection?

Can a client script provide to the browser a certificate to accept in a wss:// connection? The WebSocket constructor does not seem to have many options. (I am designing an IoT server that lets the ...
personal_cloud's user avatar
1 vote
1 answer
200 views

How does masking in WebSockets prevent cache poisoning if the attacker can write their own WebSocket client?

I've been reading about WebSockets, and learned that they apply masking of messages using a XOR cipher. This is done in order to prevent attackers from being able to make the data they send using ...
ckruf96's user avatar
  • 11
2 votes
1 answer
407 views

What's threat if WebSocket connection only checks authentication in the `Open` event

(I had checked the similar topics this/this/this/this, but I couldn't find the exact scenario or example) Let's say I have a websocket server (MITM and XSS attacks are not in scope) where inside 'open'...
T.Todua's user avatar
  • 2,727
0 votes
1 answer
1k views

How to view all SSL certificates for a website using Google Chrome?

How to view all SSL certificates for a website using Chrome? When I click the lock icon, it shows only one certificate. The Security tab shows the same - details of only one certificate. How can I see ...
The Amateur Coder's user avatar
1 vote
0 answers
167 views

Is SSL over WebSocket less necessary when a connection is established from a smartphone?

I am developing a modification for a game server. The mod hosts a SocketServer which clients can connect to using a smartphone app, allowing them to chat with other players whilst not physically ...
user270184's user avatar
0 votes
1 answer
192 views

Is it secure to send messages between a WS Server and the client?

Is it secure to send messages between a WebSocket Server and the Client? An example of sending messages between a (Socket.io) server, is in Node.js: socket.on("myMessage", function(msg) { // ...
Parking Master's user avatar
0 votes
1 answer
571 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
litz's user avatar
  • 3
3 votes
2 answers
520 views

Protecting a PWA authentication token on a public kiosk device

I have a use case where I need a factory-reset tablet device to install and run a simple Progressive Web Application (PWA). The tablet will be mounted on a wall inside a company building that may host ...
sammy34's user avatar
  • 133
1 vote
2 answers
2k views

Does sending hashed password over url path parameter secure?

I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to ...
Kacper G.'s user avatar
  • 113
1 vote
1 answer
155 views

Embed Private Key Inside Agent [closed]

We are owing a domain with wildcard certificate (*.mycompany.com). Now we have an application running as an agent on the customer machine. The browser is communicating with the agent by sending ...
Imran Qadir Baksh - Baloch's user avatar
1 vote
1 answer
406 views

When Securing a Websocket connection, does the url have to be hard coded?

I have been looking at tips to securing Websocket Connections and found this article https://portswigger.net/web-security/websockets which states that one should "Hard code the URL of the ...
MXBuster's user avatar
0 votes
1 answer
315 views

Upgrade to the WebSocket protocol and security

According to my understanding there is upgrade to the WebSocket protocol during the WebSocket handshake. We use HTTPS connections (we do not use HTTP). Should we configure the WebSocket protocol in a ...
Michael's user avatar
  • 1,469
1 vote
2 answers
1k views

Why WebSockets doesn't apply SOP?

I can't understand why SOP (same-origin policy) cannot block Cross-Origin WebSocket Hijacking, I just read this article and I can't understand from where WebSocket requests comes from. From where does ...
user avatar
23 votes
8 answers
8k views

Protect API from being tampered?

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...
VladiC4T's user avatar
  • 389
57 votes
3 answers
11k views

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost. This ...
ETL's user avatar
  • 631
0 votes
1 answer
1k views

Prevent Cross-site WebSocket hijacking with a custom header and no CORS

Considering I am vulnerable to Cross-site WebSocket hijacking, so my WebSocket handshake (GET to example.com/wss) does not require a random (CSRF) token. I have defined no CORS settings, so no custom ...
GarlicCheese's user avatar
0 votes
1 answer
1k views

Is sending token authentication information via cookie headers secure?

I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
neowenshun's user avatar
1 vote
1 answer
187 views

How to ensure security in desktop application using WebSockets locally?

I am developing an application containing both Python backend and frontend using Electron. There is no authentication. The two components communicate through WebSocket. How should I prevent the third ...
sitnarf's user avatar
  • 113
0 votes
2 answers
667 views

Hijacking Websocket - it is possible to change the server response?

i read every available hijacking websocket guide/explanation there is in the wild but i still don't understand one thing. In a CSWSH it is possible to custom requests to the server and retrieve ...
Mr. ToxicMan's user avatar
1 vote
1 answer
219 views

Security in web sockets

Scope: penetration testing of web server with critical information in it (user management). I had an argument with my college about security in web sockets and I got stuck with him in one topic, ...
getfitasap555's user avatar
1 vote
1 answer
6k views

How to sniff direct websocket connection in android ( i.e. no HTTP Upgrade connections ) using BURP?

I've pentested a lot of websites and a few apps too but this app eludes them all. On the websites, when there's a websocket upgrade the BURP proxy recognizes it and starts showing it in the websockets ...
temporarya's user avatar
1 vote
1 answer
518 views

Websockets: Is it safe to allow tokens in url parameters?

For an API, I know that passing tokens in the url has the following security implications: They get saved in browser history They’re probably saved in your server’s logs and memory Users might post ...
Anonymous Platypus's user avatar
1 vote
2 answers
338 views

What are the best practices for naming backend-internal WebSocket endpoints?

In the backend I am currently working on I have a servlet (call it S) and a WebSocket endpoint (call it E). S needs to communicate with E, yet, as of now, any WebSocket client may connect to E. My ...
coderodde's user avatar
  • 113
2 votes
0 answers
270 views

Reverse TCP - Bind to a specific port

So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
Ranganatha Rao's user avatar
1 vote
1 answer
2k views

Is sql injection possible on this websocket?

I was testing a websocket when i found an add to cart request like the following ["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"] I tried to edit the value of ...
Disp Lay's user avatar
1 vote
1 answer
562 views

How secure is Websocketd?

Is it secure enough for extremely sensitive information like used in banks? What kind of attack vectors and vulnerabilities does it have? Is the technology used making the contraption safe enough? ...
Sir Muffington's user avatar
0 votes
0 answers
32 views

How can I authenticate websocket over HTTP connection? [duplicate]

I have to communicate over HTTP connection only. A WebSocket server is setup in Tomcat. A web application is also running on the server. Now, I have a scenario in which a client will login into the ...
Kashyap Kansara's user avatar
3 votes
1 answer
2k views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
Thilina Ashen Gamage's user avatar
0 votes
1 answer
2k views

Websocket connection hostname check

I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. ...
b4da's user avatar
  • 710
0 votes
2 answers
10k views

Bypassing valid certificate requirement for websockets

I'm attempting to connect to a websocket server hosted in C# using SuperWebSockets from a page. The issue is that the websocket server generates a self-signed certificate making it difficult to ...
Rob Gates's user avatar
  • 259
2 votes
1 answer
1k views

Websocket Authentication at Opening Handshake Sufficient?

Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header. Suppose the websocket ...
fitcfitcfatc's user avatar
0 votes
2 answers
2k views

Websocket connection spoofing

I have a websocket server, where client credentials get validated upon connecting and are never bothered again, since connections are stored in memory. I was wondering, a TCP connection is basically ...
php_nub_qq's user avatar
2 votes
0 answers
832 views

Using a GUID as an authentication token (and how it could be improved)

I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using ...
Alessandro's user avatar
1 vote
0 answers
2k views

Is there a way to replay WebSocket messages? [closed]

Burp Suite can intercept WebSocket messages ("WebSockets history" under "Proxy" tab) but does not seem to be able to resend (at least not yet, according to this). I was wondering what techniques or ...
PFrancisco's user avatar
0 votes
1 answer
256 views

What is a good way to authorize a client at a time to perform an action through websockets?

I am working on a round based web game where only one client/player at a time can perform an action. Throughout the game every player will have a websocket connection to the server. The client will ...
FuryFart's user avatar
  • 109
1 vote
1 answer
2k views

Integrate PHP and WebSocket authentication securely

I have a PHP server that runs a website, and the website has features such as live notifications, which are basically notifications that get sent to you once a user likes or comments on one of your ...
Ben Beri's user avatar
  • 121
2 votes
2 answers
2k views

JS injected to database using img

How do we best prevent XSS scripted img / html element injected to our database? Recently I got a case in our website which is using PHP . Our website got a message service which allows HTML elements ...
xyonme's user avatar
  • 131
3 votes
0 answers
216 views

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
Silly Freak's user avatar
0 votes
1 answer
681 views

What is a good way of embedding rsa encryption into a messaging app

I'm learning cryptography and stuck with a problem. Suppose I have a chat app that uses sockets. Before the massage is sent it's encripted with the RSA algorithm; what are some good strategies to ...
Ivan P's user avatar
  • 101
4 votes
1 answer
3k views

Does fetch() of an https: resource verify certificate chain?

The fetch() spec doesn't deal with SSL/TLS since these are socket-level protocols. So I assume that it implements it's calls to lower level connection services to ensure that certificates are verified ...
Lindsay Morsillo's user avatar
2 votes
0 answers
263 views

HTTPS basic auth protected AJAX Token

I have a website (https) that has basic auth enabled for /token subdir I have websocket ws going through Nginx to become wss I want to create a bi-directional api on the websocket so that end users ...
CaffeineAddiction's user avatar
0 votes
1 answer
354 views

Encrypt a file in the server and decrypt it in the client without risking the user accessing it?

How can I send an encrypted file from a server to a client, encrypt and use it in the client without risking the user to access it? I saw an answer where the server saved a file in its memory, and ...
user avatar
3 votes
1 answer
896 views

Is it possible to verify a socket connection is coming from a particular web page?

Suppose you implement a streaming api based on websockets at stream.myapp.com. One of the consumers of this api is your website myapp.com. My question is whether stream.myapp.com can verify ...
The Puma's user avatar
  • 131
4 votes
1 answer
1k views

Security implications of allowing websites to open TCP sockets

I was reading a post about tcp sockets in the browser here and one of the mentioned reasons for not allowing it is that allowing websites to open TCP sockets would be a security risk but doesn't ...
Qwertie's user avatar
  • 778
12 votes
2 answers
19k views

Why can't websockets support custom headers?

This question is related to this question I asked To summarise, I'm playing with websockets at the moment and I'm trying to understand how to authenticate a client connecting to the server using a ...
stickman's user avatar
  • 1,590
1 vote
1 answer
4k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
user1318135's user avatar