Origin Validation

Validate WebSocket Origins Before Accepting Browser Connections

A WebSocket connection can stay open for minutes or hours and carry commands in both directions. If a browser automatically attaches an authenticated session to the opening handshake, a hostile web page may be able to start that connection in the user’s browser unless the server checks which site initiated it. That creates a cross-site trust problem. The user can be signed in to app.example, visit another site in a separate tab, and still have the browser make requests that involve credentials associated with app.example. A WebSocket server that accepts the handshake based only on those credentials can give an untrusted page access to an authenticated channel.