WebSocket security

What it means

A WebSocket is a connection that stays open after the first request, so the browser and the server can send messages to each other at any time. Chat, live prices, notifications and collaborative editing all use them. It starts as an ordinary HTTP request and is then upgraded.

WebSocket security is the work of making that open channel as careful as your normal pages. The handshake can be checked once, but the messages that follow arrive without the usual request-by-request checks unless you add them yourself. That gap is where most WebSocket problems live.

Why it matters

Teams often protect their regular endpoints well and forget the socket beside them. A message handler that trusts whatever arrives can read another account's data, run an admin action, or accept input that would have been filtered anywhere else. The channel also stays open for hours, so one bad decision at the start lasts.

Browsers do not apply the same-origin policy to WebSocket connections, and they attach cookies to the handshake. A hostile page can therefore ask your server for a socket in a visitor's name unless you check where the request came from.

How it shows up

You meet it in live dashboards, chat, trading screens and support widgets. The repeating mistakes are a handshake that never checks the Origin header, authentication done once and never again, no check on who owns the room or record named in a message, and no limit on message size or rate.

Check the origin on the server, use wss:// so traffic is encrypted, and treat every message as untrusted input. Authorise each action as it arrives, expire or refresh sessions on long connections, and cap how much one client can send.