Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1385: Missing Origin Validation in WebSockets

Variant Incomplete

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

How to prevent it (7 mitigations)

  1. Implementation

    Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.

  2. Implementation

    Use a randomized CSRF token to verify requests.

  3. Implementation

    Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.

  4. Architecture and Design, Implementation

    Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.

  5. Implementation

    Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.

  6. Implementation

    Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.

  7. Implementation

    Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.

Source: MITRE CWE-1385

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.