Securing Websockets

Question

Right now our application is designed to facilitate all communication via websockets after the initial load.

We are trying to figure out a solution to safely pass sensitive data via this transport.

So far we are thinking about a few things:

Authentication of the websocket transport by passing back a unique hash stored in a session cookie delivered via SSL on initial load.
Client-side encryption using something like a javascript bcrypt implementation to encrypt everything before it is transported.
Just passing all sensitive data with a normal post via SSL even though we dont want to.

Something like number 1 would be the best outcome but we are unaware if websokets are vulnerable to things like man in the middle attacks even after authentication.

Any help sussing out possible security downfalls, or any other ideas on how to achieve true security over websockets would be greatly appreciated!

Explain... what does socket.io have? We are using socket.io but I'm unaware of the security features. — fancy, Aug 07 '11 at 10:26
socket.io does have SSL support and has authorization+handshaking support => https://github.com/LearnBoost/socket.io/wiki/Authorizing — Alfred, Aug 07 '11 at 17:22

score 37 · Accepted Answer · edited Jul 06 '15 at 07:13

Connecting to a wss:// WebSocket URL rather than ws:// will use the browser's standard TLS/SSL encryption to connect to the server. It's equivalent to HTTPS vs HTTP. If you trust your browser's SSL/TLS implementation then you can trust WebSocket wss:// connections since they use the same engine. You will need to have a signed SSL certificate configured with your websocket server, but that's pretty much required anyways.

score 2 · Answer 2 · answered Sep 20 '15 at 23:41

2

Securing(encrypting using SSL/TLS) is very import for your data. But you should consider authentication as well. Anyone with ws capable device that know your endpoint for your server will be able to get data if it doesn't require authentication first. See http://simplyautomationized.blogspot.com/2015/09/5-ways-to-secure-websocket-rpi.html Includes a 3-way handshake method (CHAP) which requires both client and server to have a "pre-shared secret".
Other ways are detailed on the post.

Cheers

answered Sep 20 '15 at 23:41

Entrabiter

752
7
13

I looked at that website of yours and it is not clear what a person writing the WebSocket server has to do. Does the server have to be HTTPS mode only? – Sonny Nov 20 '15 at 02:36
@Sonny no you will need to write a routine to handle the handshake it isn't part of the HTTPS/SSL standard. – Entrabiter Nov 22 '15 at 02:09

score 1 · Answer 3 · answered Aug 14 '11 at 19:23

With regard to cookies, it might be worth considering, that (currently), the WebSockets protocol spec does not require a browser to provide all, or even any of the cookies that were set by the web server originally serving the JavaScript you use to open a WebSockets connection to that server.

See here for a description of how Firefox behaves (from a FF developer).

Securing Websockets

3 Answers3

Linked