Hacktricks websocket

1. Can WebSockets be hijacked?
2. What will replace WebSockets?
3. Are WebSockets a security risk?
4. What is the problem with WebSockets?
5. Can WebSockets be spoofed?
6. Are WebSockets blocked by Firewall?
7. What is better than WebSocket?
8. Is WebRTC better than WebSockets?
9. Is TCP faster than WebSocket?
10. What is WebSocket hijacking?
11. Is WebSocket more secure than HTTPS?
12. Does Bitcoin use WebSockets?
13. What are the disadvantages of WebSockets?
14. Is WebSocket more secure than https?
15. Can WebSocket messages get lost?
16. Would WebSockets be able to handle 1000000 concurrent connections?
17. What is better than WebSockets?
18. How much RAM does a WebSocket use?
19. Is WebSocket faster than HTTP?

Can WebSockets be hijacked?

Also known as cross-origin WebSocket hijacking. It is a Cross-Site Request Forgery (CSRF) on a WebSocket handshake. It arises when the WebSocket handshake request relies solely on HTTP cookies for session handling and does not contain any CSRF tokens or other unpredictable values.

What will replace WebSockets?

WebTransport is a new specification that could offer an alternative to WebSockets. For applications that need low-latency, event-driven communication between endpoints, WebSockets has been the go-to choice, but WebTransport may change that.

Are WebSockets a security risk?

Some WebSockets security vulnerabilities arise when an attacker makes a cross-domain WebSocket connection from a web site that the attacker controls. This is known as a cross-site WebSocket hijacking attack, and it involves exploiting a cross-site request forgery (CSRF) vulnerability on a WebSocket handshake.

What is the problem with WebSockets?

The most common cause of Websocket error is when you connect to DSS through a proxy. Websockets is a fairly recent protocol and many enterprise proxies do not support it. The websocket connection will not establish and you will see this message.

Can WebSockets be spoofed?

If you build your websocket over HTTP, then yes, it is completely possible for a third party to spoof the connection (and also to eavesdrop). If your HTTPS/WSS system does not properly validate certificates, then that also can be spoofed.

Are WebSockets blocked by Firewall?

WebSocket connections generally work even if a proxy or firewall is in place. This is because they use ports 80 and 443 which are also used by HTTP connections. In some situations WebSocket connections are blocked over port 80. In this case a secure SSL connection using WSS over port 443 should successfully connect.

What is better than WebSocket?

Server-Sent Events is a good alternative to WebSockets for simple realtime use cases that only require one-way communication (from server to client). Examples include read-only realtime apps like stock tickers, or news updates.

Is WebRTC better than WebSockets?

WebRTC is known to offer peer-to-peer (P2P) communication capabilities for mobile and browser apps using the UDP whereas WebSockets establishes a client-server connection with the aid of TCP protocol. And so, WebRTCs are known to be considerably faster than WebSockets.

Is TCP faster than WebSocket?

WebSockets performs quite well, with an average round trip time of about 20 microseconds (0.02 milliseconds), but straight up TCP still beats it handily, with an average round trip time of about 2 microseconds (0.002 milliseconds), an order of magnitude less.

What is WebSocket hijacking?

Cross-site WebSocket hijacking, also known as cross-origin WebSocket hijacking, involves a cross-site request forgery (CSRF) vulnerability on a WebSocket handshake.

Is WebSocket more secure than HTTPS?

wss is secure only because it means "WebSocket protocol over https". WebSocket protocol itself is not secure. There is no Secure WebSocket protocol, but there are just "WebSocket protocol over http" and "WebSocket protocol over https". See also this answer.

Does Bitcoin use WebSockets?

Cryptocurrency users

websockets appears to be quite popular for interfacing with Bitcoin or other cryptocurrency trackers.

What are the disadvantages of WebSockets?

The biggest downside to using WebSocket is the weight of the protocol and the hardware requirements that it brings with it. WebSocket requires a TCP implementation, which may or may not be a problem, but it also requires an HTTP implementation for the initial connection setup.

Is WebSocket more secure than https?

wss is secure only because it means "WebSocket protocol over https". WebSocket protocol itself is not secure. There is no Secure WebSocket protocol, but there are just "WebSocket protocol over http" and "WebSocket protocol over https". See also this answer.

Can WebSocket messages get lost?

It can happen. TCP guarantees the order of packets, but it does not mean that all packets sent from a server reach a client even when an unrecoverable trouble happens in an underlying network.

Would WebSockets be able to handle 1000000 concurrent connections?

The answer is complicated by several factors, but 1,000,000 simultaneous active socket connections is possible for a properly sized system (lots of CPU, RAM and fast networking) and with a tuned server system and optimized server software.

What is better than WebSockets?

Server-Sent Events is a good alternative to WebSockets for simple realtime use cases that only require one-way communication (from server to client). Examples include read-only realtime apps like stock tickers, or news updates.

How much RAM does a WebSocket use?

With websockets' defaults, on the server side, a single connections uses 70 KiB of memory.

Is WebSocket faster than HTTP?

All the frequently updated applications used WebSocket because it is faster than HTTP Connection. When we do not want to retain a connection for a particular amount of time or reuse the connection for transmitting data; An HTTP connection is slower than WebSockets.