🔓

WebSocket Security

Complex

Free preview · 2 of 5 steps

WebSocket bypasses Same-Origin Policy

HTTP requests from a browser respect Same-Origin Policy — scripts on evil.com can't read responses from bank.com. But WebSocket connections are different: the browser attaches cookies automatically, just like cross-site requests.

If bank.com doesn't check the Origin header, any website can open a WebSocket to bank.com with the victim's session — Cross-Site WebSocket Hijacking (CSWSH).

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step