WebSockets... Are they unsafe?

Question

I was working on HTML5 and I came across this site http://www.rumpetroll.com. It is a very very cool site, but then I noticed the relative ease with which people could crash the site because they could overload the sending message scheme... Also I saw a butt load of javascript injection hacks being done on it, by various users and that got me thinking?

Does inclusion of websockets really mess with the security structure of your website, by which I mean, do we need to be extra careful to avoid hacks and crashes? Please provide me with a reference article on the same or a good tutorial source for websockets... thanks :)

Answer 1

As any technology implementation, security is up to you.

PHP Sessions aren't safe as you can imagine for example. Check out Chris Shiflett articles for explanation on those.

http://shiflett.org/articles

I recommend for these new Javascript technology some reading about Cross-Origin Resources Sharing, Cross-Document Messaging and Web Sockets for further understanding about implementations and security drawbacks.

A good point for start searching on those topics (and many others) is http://caniuse.com/.

Remember, any raw implementation is a hole in security. Security needs to be worked out always, for any feature you want to implement.

Answer 2

Web sockets is a client-server side technology and as such depends on the server implementation as well as the browsers. You must always be extra careful to avoid hacks and crashes and with new technologies even more so. My advice is to follow good security guidelines and to design things that need protection secure from the ground up. I cannot provide you with more articles or tutorials than the web can. If you want in depth knowledge about a topic, buy a book, if there is no book written yet, you get the honor to be a pioneer in it :) Then you may write a book and get rich. Good luck!

Answer 3

There is a decent WebSocket Tutorial that will teach you the basics, but really security and implementation is up to you. I do a lot of additional things backend to cover in case it's being abused that I don't mention because really it's off the topic of a basic tutorial.

Check for proper domains and restrict accordingly. Understand that you can't ever trust the client side. The necessity of having a good majority of the code available client side means you have to validate every message to ensure that it is really coming from your application.