Weakness (CWE)

CWE-1385: Missing Origin Validation in WebSockets

Variant Incomplete

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

How to prevent it (7 mitigations)

Implementation

Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
Implementation

Use a randomized CSRF token to verify requests.
Implementation

Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.
Architecture and Design, Implementation

Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.
Implementation

Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.
Implementation

Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.
Implementation

Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.

Traccar Missing Origin Validation in WebSockets