Where WebSockets go wrong

4 min read

WebSockets skip a lot of the defences HTTP grew over thirty years, which is exactly why they are worth probing.

• No same-origin protection by default. The handshake carries an Origin header, but the server has to actually check it. If it does not, any site can open a socket to it in a logged-in victim's browser — cross-site WebSocket hijacking.
• Messages are trusted. Frames are just as injectable as HTTP bodies — SQL, XSS into whatever renders the message, command injection. The framing changes; the input handling does not.
• State the client should not set. A "role" or "price" pushed in a JSON frame and believed by the server is the same broken-trust bug as a tampered cookie, minus the scrutiny.
• Server pushes leak. Servers push config, presence, and debug frames the UI quietly ignores — and, being server-sent, they are unmasked and plainly readable in a capture.