Agent WranglersAPS-38Recommended
Check the origin of WebSocket connections
Accept a WebSocket connection only from your own origins, and only after checking the user's login, as for any other request.
How to do it
CORS does not cover WebSocket handshakes, and browsers send cookies with it from any site unless the cookie is marked SameSite=Lax or Strict. Compare the Origin header with your list during the handshake. Check the user's rights on each message that reads or changes data.
Examples
Shell example
curl -si --http1.1 --max-time 5 -H 'Connection: Upgrade' -H 'Upgrade: websocket' -H 'Sec-WebSocket-Version: 13' \
-H 'Sec-WebSocket-Key: QVctVEVTVC1rZXktMTIzNA==' -H 'Origin: https://evil.example.net' \
https://staging.example.com/ws | head -1 # 403, not 101How to check
The agent opens a WebSocket to staging with Origin: https://evil.example.net and the test user's cookie. The handshake is refused.
Sources
Related rules
- API-70 Check access when the connection opens and while it lasts in API design
- NTF-33 Deliver new items live and catch up after a gap in Notifications
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/websocket-origin">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.