Menu
Right now our application is designed to facilitate all communication via websockets after the initial load.
We are trying to figure out a solution to safely pass sensitive data via this transport.
So far we are thinking about a few things:
Client-side encryption using something like a javascript bcrypt implementation to encrypt everything before it is transported.
Just passing all sensitive data with a normal post via SSL even though we dont want to.
Something like number 1 would be the best outcome but we are unaware if websokets are vulnerable to things like man in the middle attacks even after authentication.
Any help sussing out possible security downfalls, or any other ideas on how to achieve true security over websockets would be greatly appreciated!
681
Some WebSockets security vulnerabilities arise when an attacker makes a cross-domain WebSocket connection from a web site that the attacker controls. This is known as a cross-site WebSocket hijacking attack, and it involves exploiting a cross-site request forgery (CSRF) vulnerability on a WebSocket handshake.
Like HTTPS, WSS (WebSockets over SSL/TLS) is encrypted, thus protecting against man-in-the-middle attacks. A variety of attacks against WebSockets become impossible if the transport is secured.
To create a secure (TLS/SSL) Websocket server with Node. js, we can use the https module. const WebSocket = require("ws"). Server; const { createServer } = require("https"); const fs = require("fs"); const server = createServer({ cert: fs.
Connecting to a wss:// WebSocket URL rather than ws:// will use the browser's standard TLS/SSL encryption to connect to the server. It's equivalent to HTTPS vs HTTP. If you trust your browser's SSL/TLS implementation then you can trust WebSocket wss:// connections since they use the same engine. You will need to have a signed SSL certificate configured with your websocket server, but that's pretty much required anyways.
182
Securing(encrypting using SSL/TLS) is very import for your data. But you should consider authentication as well. Anyone with ws capable device that know your endpoint for your server will be able to get data if it doesn't require authentication first.
See http://simplyautomationized.blogspot.com/2015/09/5-ways-to-secure-websocket-rpi.html
Includes a 3-way handshake method (CHAP) which requires both client and server to have a "pre-shared secret".
Other ways are detailed on the post.
Cheers
42
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
