News for hackers. Stuff that matters.

A comment on The WebSocket Handbook. Parent comment

Re:The WebSocket Handbook by latch on Tuesday January 11, 2022 @01:01PM (#29895125)
Don't have access to the headers from JS.

Best solution might be to generate a short-lived one-time-use ticket and pass it in the querystring.

[ Parent | on HN ]
Re:The WebSocket Handbook by twic on Tuesday January 11, 2022 @03:38PM (#29897495)
If you make a normal HTTP request first, the server can issue a standard HTTP cookie to the client. That cookie will then be included when the browser makes the websocket request.

However, websockets are not subject to the same-origin policy, so this exposes you to CSRF [1]. To protect against that, you should check the Origin header on the server side.

[1] https://christian-schneider.net/CrossSiteWebSocketHijacking....

[ Parent | on HN ]
Re:The WebSocket Handbook by simonkagedal on Tuesday January 11, 2022 @03:31PM (#29897400)
Cookies will be forwarded though, or..?
[ Parent | on HN ]