WebSocket Handshake and Security

WebSocket upgrades an HTTP connection into a bidirectional message channel.

Validate the Origin and authentication context during the handshake, authorize each connection, bound message size and rate, and close idle or unauthorized connections deliberately.

httpwebsocketsecurityrealtime

Reference (http)

GET /socket HTTP/1.1
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: BASE64_NONCE

Validate the Origin and authentication context during the handshake, authorize each connection, bound message size and rate, and close idle or unauthorized connections deliberately.

Common mistakes

Treating a successful Upgrade as authorization, accepting every Origin, or forgetting that cookies can authenticate a cross-site handshake.

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet