Weakness (CWE)
CWE-1385: Missing Origin Validation in WebSockets
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
How to prevent it (7 mitigations)
-
Implementation
Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
-
Implementation
Use a randomized CSRF token to verify requests.
-
Implementation
Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.
-
Architecture and Design, Implementation
Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.
-
Implementation
Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.
-
Implementation
Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.
-
Implementation
Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.
Source: MITRE CWE-1385
2 results · Clear filters · Feed
-
Low 2.3
Next.js: null origin can bypass dev HMR websocket CSRF checks
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDe…
-
Low 2.3
Information exposure in Next.js dev server due to lack of origin verification
Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enab…