Cómo a Implement Seguro WebSockets

Establish y maintain seguro WebSocket (WSS) connections con proper authentication, origin validation, y mensaje integrity.

问题

WebSocket connections puede ser hijacked, lack authentication, o aceptar messages de unauthorized origins. You necesitar a implement seguro WebSockets (wss://) con proper authentication, origin checking, y protection against común attacks.

Requisitos previos

Understanding of WebSocket protocol (RFC 6455)
Familiarity with TLS and the wss:// scheme
Knowledge of HTTP authentication and CORS

Pasos

1. Establish WSS with TLS and authentication

Always use wss:// (WebSocket Secure over TLS), never ws:// in production. Perform authentication during the WebSocket handshake: pass a token in the initial HTTP upgrade request (via Authorization header, query parameter, or Sec-WebSocket-Protocol subprotocol). Validate the token before accepting the upgrade. The server must reject the upgrade (HTTP 401/403) if authentication fails. Use the WebSocket frame encoder/decoder to understand the protocol.
entrada
```
GET /ws HTTP/1.1 | Upgrade: websocket | Authorization: Bearer <token>
```
输出
```
HTTP 101 Switching Protocols (if auth valid) | HTTP 401 (if auth fails)
```
2. Validate the Origin header

Check the Origin header on the upgrade request against an allow-list of trusted origins. This prevents Cross-Site WebSocket Hijacking (CSWSH) where a malicious website opens a WebSocket to your server using the victim's browser credentials. Reject requests with missing or untrusted origins with HTTP 403. Do not use CORS for WebSockets — Origin checking is the WebSocket-specific mechanism. Use the URL parser to validate origin format.
entrada
```
Origin: https://trusted.example.com
```
输出
```
origin_check: pass | (Origin: https://evil.com -> reject 403)
```
3. Implement message validation and rate limiting

Validate every incoming message against a schema (JSON Schema, protobuf) before processing. Reject malformed, oversized, or unexpected message types. Enforce a maximum message size (e.g., 1MB) and rate limit per connection (messages per second). Use ping/pong frames for keepalive and to detect dead connections. Set reasonable timeouts for idle connections. Use the JSON validator and WebSocket frame decoder for message inspection.
entrada
```
message: { type: chat, text: hello }
```
输出
```
valid: true | processed | (oversized: reject 1009 Message Too Big)
```
4. Secure the connection lifecycle

Implement proper connection cleanup: close connections on authentication expiry, set idle timeouts, and handle close codes (1000 normal, 1001 going away, 1008 policy violation, 1011 internal error). Re-authenticate on reconnection. Never send sensitive data in broadcast messages. Log connection events for audit. For multi-server deployments, use a shared session store and authenticate on each server, not just the one that received the upgrade.
entrada
```
token expired mid-session
```
输出
```
close: 1008 Policy Violation | reason: auth expired
```

Resultado esperado

Seguro WebSocket connections con TLS, per-connection authentication, origin validation, mensaje esquema enforcement, y rate limiting.

Errores comunes

Using ws:// instead of wss:// in production: Always use wss:// (TLS). ws:// sends all data including tokens in plaintext, vulnerable to interception and modification.
Not validating the Origin header: Without Origin validation, any website can open a WebSocket to your server using the user's browser session. Always check Origin against an allow-list.
Authenticating only at connection, not per-message: For long-lived connections, the initial token may expire. Re-validate periodically or on sensitive operations. Close connections with expired credentials.

Solución de problemas指引

If connections drop frequently, check proxy/load balancer WebSocket support and timeout settings (e.g., Nginx proxy_read_timeout).
If the Origin check blocks legitimate connections, ensure your CDN/proxy forwards the Origin header correctly.
For large messages, consider chunking or using a separate file upload channel rather than sending large payloads over WebSocket.

Límites de seguridad

WebSocket connections are stateful and long-lived — a compromised token remains valid until the connection closes or the token is re-validated.
All authentication and message validation happen server-side; the client must not be trusted to enforce security policies.
Broadcast messages can leak data to unauthorized clients if not filtered per-recipient.