News for hackers. Stuff that matters.

A comment on The WebSocket Handbook. Parent comment

Re:The WebSocket Handbook by JSdev1 on Tuesday January 11, 2022 @12:17PM (#29894379)
It's the same thing as HTTP. Websocket starts off as an HTTP request with cookies, headers etc. Use those just like HTTP to authenticate, and your Websocket server should pass the user data to the websocket object
[ Parent | on HN ]
Re:The WebSocket Handbook by latch on Tuesday January 11, 2022 @01:01PM (#29895125)
Don't have access to the headers from JS.

Best solution might be to generate a short-lived one-time-use ticket and pass it in the querystring.

[ Parent | on HN ]
Re:The WebSocket Handbook by twic on Tuesday January 11, 2022 @03:38PM (#29897495)
If you make a normal HTTP request first, the server can issue a standard HTTP cookie to the client. That cookie will then be included when the browser makes the websocket request.

However, websockets are not subject to the same-origin policy, so this exposes you to CSRF [1]. To protect against that, you should check the Origin header on the server side.

[1] https://christian-schneider.net/CrossSiteWebSocketHijacking....

[ Parent | on HN ]
Re:The WebSocket Handbook by simonkagedal on Tuesday January 11, 2022 @03:31PM (#29897400)
Cookies will be forwarded though, or..?
[ Parent | on HN ]