Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [websocket]

The tag has no usage guidance.

0
votes
1answer
41 views

Bypassing valid certificate requirement for websockets

I'm attempting to connect to a websocket server hosted in C# using SuperWebSockets from a page. The issue is that the websocket server generates a self-signed certificate making it difficult to ...
1
vote
1answer
105 views

Websocket Authentication at Opening Handshake Sufficient?

Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header. Suppose the websocket ...
0
votes
2answers
136 views

Websocket connection spoofing

I have a websocket server, where client credentials get validated upon connecting and are never bothered again, since connections are stored in memory. I was wondering, a TCP connection is basically ...
2
votes
0answers
100 views

Using a GUID as an authentication token (and how it could be improved)

I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using ...
1
vote
0answers
256 views

Is there a way to replay WebSocket messages? [closed]

Burp Suite can intercept WebSocket messages ("WebSockets history" under "Proxy" tab) but does not seem to be able to resend (at least not yet, according to this). I was wondering what techniques or ...
0
votes
1answer
47 views

What is a good way to authorize a client at a time to perform an action through websockets?

I am working on a round based web game where only one client/player at a time can perform an action. Throughout the game every player will have a websocket connection to the server. The client will ...
1
vote
1answer
633 views

Integrate PHP and WebSocket authentication securely

I have a PHP server that runs a website, and the website has features such as live notifications, which are basically notifications that get sent to you once a user likes or comments on one of your ...
2
votes
2answers
267 views

JS injected to database using img

How do we best prevent XSS scripted img / html element injected to our database? Recently I got a case in our website which is using PHP . Our website got a message service which allows HTML elements ...
3
votes
0answers
67 views

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
0
votes
1answer
78 views

What is a good way of embedding rsa encription into a messaging app

I'm learning cryptography and stuck with a problem. Suppose I have a chat app that uses sockets. Before the massage is sent it's encripted with the RSA algorithm; what are some good strategies to ...
4
votes
1answer
436 views

Does fetch() of an https: resource verify certificate chain?

The fetch() spec doesn't deal with SSL/TLS since these are socket-level protocols. So I assume that it implements it's calls to lower level connection services to ensure that certificates are verified ...
2
votes
0answers
157 views

HTTPS basic auth protected AJAX Token

I have a website (https) that has basic auth enabled for /token subdir I have websocket ws going through Nginx to become wss I want to create a bi-directional api on the websocket so that end users ...
0
votes
1answer
73 views

Encrypt a file in the server and decrypt it in the client without risking the user accessing it?

How can I send an encrypted file from a server to a client, encrypt and use it in the client without risking the user to access it? I saw an answer where the server saved a file in its memory, and ...
4
votes
1answer
265 views

Is it possible to verify a socket connection is coming from a particular web page?

Suppose you implement a streaming api based on websockets at stream.myapp.com. One of the consumers of this api is your website myapp.com. My question is whether stream.myapp.com can verify ...
4
votes
1answer
245 views

Security implications of allowing websites to open TCP sockets

I was reading a post about tcp sockets in the browser here and one of the mentioned reasons for not allowing it is that allowing websites to open TCP sockets would be a security risk but doesn't ...
2
votes
1answer
6k views

Why can't websockets support custom headers?

This question is related to this question I asked To summarise, I'm playing with websockets at the moment and I'm trying to understand how to authenticate a client connecting to the server using a ...
1
vote
1answer
2k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
2
votes
1answer
825 views

Is it secure to rely on websocket connection?

In a client-server communication scenario over secure websocket, client is authorized securely and from there on, I have two choices: Assign a unique random ID (session) and check that on subsequent ...
1
vote
0answers
32 views

WSS assign login token on socket?

Is it secure to assign the login token on the socket object? This would be done to avoid having to consistently send their tokens over an encrypted established WebSocket connection. The token would be ...
1
vote
0answers
242 views

Check if a Websocket connection origins from a Chrome extension [closed]

I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...
2
votes
2answers
152 views

Integrity of secure WebSocket

I'm using a secure WebSocket connection (wss://...) for data transfer to and from a single-page app. Once a client has been authenticated, should I be passing some sort of authentication token with ...
0
votes
1answer
82 views

RFC 6455: Form fields with starting |Sec-| mean?

In RFC 6455 which is the Websocket Protocol specification it says: It is similarly intended to fail to establish a connection when data from other protocols, especially HTTP, is sent to a ...
0
votes
1answer
329 views

Measures to secure websockets for non-browser clients

I've been looking into the security risks that needed to be addressed when setting up an application using websockets, but the major issues I've looked at (CSRF, XSS, cross-site websocket hijacking) ...
1
vote
1answer
810 views

Secure JSON on websocket - encryption

I have an websocket connection without SSL certificate (just plain WS, not WSS). Every message is transferred as JSON (text). What might be best way to secure communication? Which encryption ...
3
votes
3answers
3k views

Do websockets represent a security problem to my local machine?

To work around a problem with IntelliJ, I have been recommended to configure my local Docker daemon to work on port 2375 without TLS authentication. I am concerned however that a malicious website ...
1
vote
1answer
959 views

Why can't I send raw HTTP requests with arbitrary headers from a web application? [closed]

I am trying to write a script to test a Suricata network signature. To do this I need to simulate the same user agent as the malware. I tried the following. $.ajaxSetup({ beforeSend: function(...
0
votes
1answer
475 views

websocket connection over TLS using nopoll fails with SSL_ERROR_SYSCALL

I am writing a messaging client that should connect to a server using websocket secure(WSS). When the client initiates nopoll connection, openssl returns SSL_ERROR_SYSCALL. The server also supports ...
5
votes
1answer
408 views

Is it worth using ModSecurity on a single entry point websocket connection?

I'm trying to evaluate benefits of using ModSecurity in our system. From that what I read till now, I have feeling it is not very useful for us. In our web app, there is single entry point, which is ...
3
votes
0answers
2k views

Authenticate JWT over websocket

I post here to know if my authentication mechanism over websocket is sound. My app API works over websocket instead of the standard HTTP rest. Each time a path that is secured is accessed over ...
0
votes
1answer
164 views

Understanding a proof of concept

I found this report about a buffer overflow vulnerability in websocify. I do not understand how this line $ curl http://example.com/$(python -c 'print "A"*5000') triggers the vulnerability. I think ...
2
votes
1answer
258 views

Getting and then distributing a wildcard SSL certificate — is this okay?

I have a stupid/crazy idea that I wanted to ask about here. It's probably not going to work, but I'm curious. Browser security won't allow insecure web sockets (ws://) from secure (https://) pages ...
0
votes
1answer
338 views

How to ensure if an SSH tunnling failed (if I haven't really tunneled)

I tunneled data transition as 22-22 and 2222-80, between my PC and VPS: ssh user@1.1.1.1 -L 22:localhost:22 -L 2222:localhost:80 -i ~/.ssh/key To make sure both tunnels were created, I executed lsof ...
4
votes
3answers
2k views

Authentication without login and password in mobile apps

I'm getting started in app development and I'm thinking about the login flow of first app. Some other apps like Whatsapp and Clash of Clans does not require any sign up or login process in order to ...
2
votes
0answers
730 views

SignalR authentication security

I would like to ask a question about security in the case of SignalR, a library for real-time HTTP communication. I see it as an abstraction layer for web-sockets with fall-back mechanisms in case the ...
7
votes
2answers
550 views

Vulnerable web sockets application for training

WebSockets have some potential new vulnerabilities, such as Cross-Site WebSocket Hijacking. Is there a vulnerable app (like Damn Vulnerable Web App, HackMeBank) that demonstrates WebSocket ...
4
votes
1answer
63 views

Mixing Off-The-Record and classic SSL

I am developing some pubsub system on top of Node.js and Socket.io. I decided to implement Off-The-Record (OTR) encryption by default for all of data transfers between clients and server(s). Question ...
1
vote
2answers
1k views

Implications of replacing Java Applets with Client Side Websocket Server

I am no security expert, but do know some concepts. We have a web application which currently uses Java Applets to do some operations on files in Client's File system (Browse, create, upload and ...
4
votes
2answers
14k views

Should I use websockets (ws) or secure websockets (wss) for my game?

I'm making a game and I'm using websockets for 99% of communication. The only http(s) is on initial page load and when logging in/registering. I'm a complete noob so correct me if I'm wrong, but SSL ...
0
votes
1answer
57 views

How to check connectivity between raspberry pi and server [closed]

How to check connectivity between raspberry pi (which act as a client) and server using web-socket
12
votes
1answer
1k views

Is a very long living WSS WebSocket Secure connection really secure?

I am far from being a security expert, so please forgive any approximation in this question. As I understand it from this (very good) answer, a suite of HTTPS connection can be summarized as such : ...
4
votes
2answers
8k views

Is the Origin header really useful for securing a WebSocket?

I've been reading some posts about WebSockets security, and a few of them mention to use the Origin header for helping secure the connection. For example this one https://www.christian-schneider.net/...
0
votes
2answers
129 views

Is there any security implication of using WebRTC over unencrypted channel for streaming?

I've spend a few hours reading about WebRTC and everywhere it's recommended to use a secure connection for contacting with the signal server, so no MitM attacks could be possible. However, my project ...
3
votes
1answer
1k views

What's the purpose of the MASK in a WebSocket?

Reading the Web Socket RFC, at 5.1 it says: a client MUST mask all frames that it sends to the server (see Section 5.3 for further details). (Note that masking is done whether or not ...
5
votes
2answers
4k views

Sec-WebSocket-Key Header

Can anyone explain me which attacks the Sec-WebSocket-Key in the WebSocket handshake addresses? I don't understand it in the RFC, neither on google.
1
vote
1answer
138 views

What is the added value of dynamic payload in Ping/Heartbeat commands?

Many protocols, including TLS and WebSocket, have a ping/heartbeat packet format that we encapsulate a variable payload that the remote end must reply back. In other terms, If I (client) send a ping ...
3
votes
0answers
65 views

Local sockets: does SSL add security? [duplicate]

Situation We have a Windows Service that is listening on a TCP port. This service is responsible for capturing a user's fingerprint using the Windows Biometric Framework, when requested to do so by a ...
2
votes
1answer
269 views

Security of Web Game over WebSockets?

Project that I'm working on depends on WebSockets to communicate between the server and client browser for all interactions within the game. I'm attending university for Computer Security, but I'm ...
2
votes
1answer
1k views

How to secure a websocket connection with challenge-response?

TL;DR Given that all of the state information for a web browser is accessible to a (potentially hostile) user, how can challenge-response authentication between the browser and the server be ...
1
vote
0answers
93 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
-1
votes
1answer
3k views

How to secure my node.js/socket.io application properly? [closed]

I do have multiple applications in .NET. Now I want that each user can talk within its application with other users of the same application. Therefore I programmed a node.js/socket.io-server. ...