Questions tagged [websocket]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
45 views

How do I stop external sites from doing ws://localhost and doing funny things to non-HTTP servers? [duplicate]

Discovered a certain site that I would rather not link was being mean and probing a bunch of ports with ws://127.0.0.1:port and wss://127.0.0.1:port. I want to put a stop to it, but how? Then ...
user avatar
  • 1,090
0 votes
1 answer
123 views

How to view all SSL certificates for a website using Google Chrome?

How to view all SSL certificates for a website using Chrome? When I click the lock icon, it shows only one certificate. The Security tab shows the same - details of only one certificate. How can I see ...
user avatar
1 vote
0 answers
89 views

Is SSL over WebSocket less necessary when a connection is established from a smartphone?

I am developing a modification for a game server. The mod hosts a SocketServer which clients can connect to using a smartphone app, allowing them to chat with other players whilst not physically ...
user avatar
0 votes
1 answer
82 views

Is it secure to send messages between a WS Server and the client?

Is it secure to send messages between a WebSocket Server and the Client? An example of sending messages between a (Socket.io) server, is in Node.js: socket.on("myMessage", function(msg) { // ...
user avatar
0 votes
1 answer
212 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
user avatar
  • 3
1 vote
1 answer
180 views

Protecting a PWA authentication token on a public kiosk device

I have a use case where I need a factory-reset tablet device to install and run a simple Progressive Web Application (PWA). The tablet will be mounted on a wall inside a company building that may host ...
user avatar
  • 113
0 votes
0 answers
180 views

Securing websockets for IPC in a desktop app

Background I'm building an Electron app. In Electron, there's a main process and renderer processes. Electron provides a built-in IPC API, that allows to communicate between the main process and a ...
user avatar
0 votes
2 answers
755 views

Does sending hashed password over url path parameter secure?

I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to ...
user avatar
  • 103
1 vote
1 answer
87 views

Embed Private Key Inside Agent [closed]

We are owing a domain with wildcard certificate (*.mycompany.com). Now we have an application running as an agent on the customer machine. The browser is communicating with the agent by sending ...
user avatar
  • 2,449
1 vote
1 answer
149 views

When Securing a Websocket connection, does the url have to be hard coded?

I have been looking at tips to securing Websocket Connections and found this article https://portswigger.net/web-security/websockets which states that one should "Hard code the URL of the ...
user avatar
0 votes
1 answer
142 views

Upgrade to the WebSocket protocol and security

According to my understanding there is upgrade to the WebSocket protocol during the WebSocket handshake. We use HTTPS connections (we do not use HTTP). Should we configure the WebSocket protocol in a ...
user avatar
  • 1,457
0 votes
2 answers
415 views

Why WebSockets doesn't apply SOP?

I can't understand why SOP (same-origin policy) cannot block Cross-Origin WebSocket Hijacking, I just read this article and I can't understand from where WebSocket requests comes from. From where does ...
user avatar
22 votes
8 answers
7k views

Protect API from being tampered?

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...
user avatar
  • 379
57 votes
3 answers
9k views

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost. This ...
user avatar
  • 631
0 votes
1 answer
613 views

Prevent Cross-site WebSocket hijacking with a custom header and no CORS

Considering I am vulnerable to Cross-site WebSocket hijacking, so my WebSocket handshake (GET to example.com/wss) does not require a random (CSRF) token. I have defined no CORS settings, so no custom ...
user avatar
0 votes
1 answer
551 views

Is sending token authentication information via cookie headers secure?

I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
user avatar
1 vote
1 answer
109 views

How to ensure security in desktop application using WebSockets locally?

I am developing an application containing both Python backend and frontend using Electron. There is no authentication. The two components communicate through WebSocket. How should I prevent the third ...
user avatar
  • 113
0 votes
2 answers
231 views

Hijacking Websocket - it is possible to change the server response?

i read every available hijacking websocket guide/explanation there is in the wild but i still don't understand one thing. In a CSWSH it is possible to custom requests to the server and retrieve ...
user avatar
1 vote
1 answer
143 views

Security in web sockets

Scope: penetration testing of web server with critical information in it (user management). I had an argument with my college about security in web sockets and I got stuck with him in one topic, ...
user avatar
1 vote
1 answer
3k views

How to sniff direct websocket connection in android ( i.e. no HTTP Upgrade connections ) using BURP?

I've pentested a lot of websites and a few apps too but this app eludes them all. On the websites, when there's a websocket upgrade the BURP proxy recognizes it and starts showing it in the websockets ...
user avatar
2 votes
1 answer
249 views

Websockets: Is it safe to allow tokens in url parameters?

For an API, I know that passing tokens in the url has the following security implications: They get saved in browser history They’re probably saved in your server’s logs and memory Users might post ...
user avatar
1 vote
2 answers
159 views

What are the best practices for naming backend-internal WebSocket endpoints?

In the backend I am currently working on I have a servlet (call it S) and a WebSocket endpoint (call it E). S needs to communicate with E, yet, as of now, any WebSocket client may connect to E. My ...
user avatar
  • 113
2 votes
0 answers
147 views

Reverse TCP - Bind to a specific port

So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
user avatar
1 vote
1 answer
1k views

Is sql injection possible on this websocket?

I was testing a websocket when i found an add to cart request like the following ["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"] I tried to edit the value of ...
user avatar
1 vote
1 answer
450 views

How secure is Websocketd?

Is it secure enough for extremely sensitive information like used in banks? What kind of attack vectors and vulnerabilities does it have? Is the technology used making the contraption safe enough? ...
user avatar
0 votes
0 answers
29 views

How can I authenticate websocket over HTTP connection? [duplicate]

I have to communicate over HTTP connection only. A WebSocket server is setup in Tomcat. A web application is also running on the server. Now, I have a scenario in which a client will login into the ...
user avatar
3 votes
1 answer
1k views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
user avatar
0 votes
1 answer
1k views

Websocket connection hostname check

I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. ...
user avatar
  • 680
0 votes
1 answer
6k views

Bypassing valid certificate requirement for websockets

I'm attempting to connect to a websocket server hosted in C# using SuperWebSockets from a page. The issue is that the websocket server generates a self-signed certificate making it difficult to ...
user avatar
  • 249
1 vote
1 answer
833 views

Websocket Authentication at Opening Handshake Sufficient?

Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header. Suppose the websocket ...
user avatar
0 votes
2 answers
1k views

Websocket connection spoofing

I have a websocket server, where client credentials get validated upon connecting and are never bothered again, since connections are stored in memory. I was wondering, a TCP connection is basically ...
user avatar
2 votes
0 answers
578 views

Using a GUID as an authentication token (and how it could be improved)

I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using ...
user avatar
1 vote
0 answers
2k views

Is there a way to replay WebSocket messages? [closed]

Burp Suite can intercept WebSocket messages ("WebSockets history" under "Proxy" tab) but does not seem to be able to resend (at least not yet, according to this). I was wondering what techniques or ...
user avatar
0 votes
1 answer
139 views

What is a good way to authorize a client at a time to perform an action through websockets?

I am working on a round based web game where only one client/player at a time can perform an action. Throughout the game every player will have a websocket connection to the server. The client will ...
user avatar
  • 109
1 vote
1 answer
2k views

Integrate PHP and WebSocket authentication securely

I have a PHP server that runs a website, and the website has features such as live notifications, which are basically notifications that get sent to you once a user likes or comments on one of your ...
user avatar
  • 121
2 votes
2 answers
1k views

JS injected to database using img

How do we best prevent XSS scripted img / html element injected to our database? Recently I got a case in our website which is using PHP . Our website got a message service which allows HTML elements ...
user avatar
  • 31
3 votes
0 answers
150 views

What are the design considerations behind exempting WebSockets from the SOP?

I was rather surprised that in my experiments, I could simply connect from one website to a WebSocket server on a different domain/port pair. Subsequent research repeatedly showed that WebSockets do ...
user avatar
0 votes
1 answer
546 views

What is a good way of embedding rsa encryption into a messaging app

I'm learning cryptography and stuck with a problem. Suppose I have a chat app that uses sockets. Before the massage is sent it's encripted with the RSA algorithm; what are some good strategies to ...
user avatar
  • 101
4 votes
1 answer
2k views

Does fetch() of an https: resource verify certificate chain?

The fetch() spec doesn't deal with SSL/TLS since these are socket-level protocols. So I assume that it implements it's calls to lower level connection services to ensure that certificates are verified ...
user avatar
2 votes
0 answers
213 views

HTTPS basic auth protected AJAX Token

I have a website (https) that has basic auth enabled for /token subdir I have websocket ws going through Nginx to become wss I want to create a bi-directional api on the websocket so that end users ...
user avatar
0 votes
1 answer
251 views

Encrypt a file in the server and decrypt it in the client without risking the user accessing it?

How can I send an encrypted file from a server to a client, encrypt and use it in the client without risking the user to access it? I saw an answer where the server saved a file in its memory, and ...
user avatar
4 votes
1 answer
464 views

Is it possible to verify a socket connection is coming from a particular web page?

Suppose you implement a streaming api based on websockets at stream.myapp.com. One of the consumers of this api is your website myapp.com. My question is whether stream.myapp.com can verify ...
user avatar
  • 141
4 votes
1 answer
718 views

Security implications of allowing websites to open TCP sockets

I was reading a post about tcp sockets in the browser here and one of the mentioned reasons for not allowing it is that allowing websites to open TCP sockets would be a security risk but doesn't ...
user avatar
  • 778
9 votes
2 answers
14k views

Why can't websockets support custom headers?

This question is related to this question I asked To summarise, I'm playing with websockets at the moment and I'm trying to understand how to authenticate a client connecting to the server using a ...
user avatar
  • 1,550
1 vote
1 answer
3k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
user avatar
3 votes
1 answer
2k views

Is it secure to rely on websocket connection?

In a client-server communication scenario over secure websocket, client is authorized securely and from there on, I have two choices: Assign a unique random ID (session) and check that on subsequent ...
user avatar
  • 296
1 vote
0 answers
73 views

WSS assign login token on socket?

Is it secure to assign the login token on the socket object? This would be done to avoid having to consistently send their tokens over an encrypted established WebSocket connection. The token would be ...
user avatar
  • 11
1 vote
0 answers
353 views

Check if a Websocket connection origins from a Chrome extension [closed]

I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...
user avatar
  • 214
3 votes
2 answers
295 views

Integrity of secure WebSocket

I'm using a secure WebSocket connection (wss://...) for data transfer to and from a single-page app. Once a client has been authenticated, should I be passing some sort of authentication token with ...
user avatar
  • 133
0 votes
1 answer
135 views

RFC 6455: Form fields with starting |Sec-| mean?

In RFC 6455 which is the Websocket Protocol specification it says: It is similarly intended to fail to establish a connection when data from other protocols, especially HTTP, is sent to a WebSocket ...
user avatar