What are WebSockets and WebSocket Vulnerabilities?

WebSockets provide a persistent, bidirectional connection between client and server. After an HTTP handshake, either side can send messages at any time. This suits chat, market data, games and live status, but controls normally applied to individual HTTP requests must be implemented at connection and message level.

How does the handshake work?

GET /socket HTTP/1.1
Host: app.example.test
Upgrade: websocket
Connection: Upgrade
Origin: https://app.example.test
Sec-WebSocket-Key: RANDOM_VALUE
Sec-WebSocket-Version: 13
Cookie: session=SESSION_VALUE

A successful upgrade returns 101 Switching Protocols. Browsers send applicable cookies automatically. Without exact Origin validation, another site may open an authenticated connection: Cross-Site WebSocket Hijacking (CSWSH). Like CSRF, it abuses ambient credentials, but may also read server messages.

Unsafe and safer upgrade handling

// Unsafe: every Origin is accepted
const wss = new WebSocketServer({ server });

server.on('upgrade', (request, socket, head) => {
  const allowed = new Set(['https://app.example.test']);
  if (!allowed.has(request.headers.origin)) return socket.destroy();

  const user = authenticateSession(request.headers.cookie);
  if (!user) return socket.destroy();

  wss.handleUpgrade(request, socket, head, (ws) => {
    ws.user = user;
    wss.emit('connection', ws, request);
  });
});

Every message also needs authorization. An authenticated connection does not grant access to every room or object. Payloads need schema validation, size limits and business authorization.

Common WebSocket vulnerabilities

• CSWSH:
  Untrusted origins use automatically sent cookies.
• Broken access control:
  Object or channel permissions are missing per message.
• Injection:
  Messages reach SQL, templates, shells or browsers unsafely.
• Denial of service:
  Unlimited connections, message size or frequency consume resources.
• Token lifecycle:
  Expired or revoked sessions remain active on long-lived connections.

Security baseline

• - Use wss:// exclusively.
• - Compare exact allowed origins; avoid wildcards, suffix checks and implicit null.
• - Authenticate the upgrade and authorize every action.
• - Enforce schemas, message/queue limits, rate limits and timeouts.
• - Apply logout, role changes and token expiry to open connections.
• - Log security events without entire sensitive messages or tokens.

Useful open-source tools

OWASP ZAP includes a WebSocket inspector. websocat is a small CLI client for reproducible handshakes and messages, while mitmproxy supports scriptable flows. No tool replaces object-level and state-transition tests.