https://nalar.dev/tags/websocket/ Recent content in WebSocket on Nalar Hugo en-us Fri, 11 Sep 2026 00:00:00 +0700 https://nalar.dev/validate-websocket-origins-before-accepting-browser-connections/ Fri, 11 Sep 2026 00:00:00 +0700 https://nalar.dev/validate-websocket-origins-before-accepting-browser-connections/ <p>A WebSocket connection can stay open for minutes or hours and carry commands in both directions. If a browser automatically attaches an authenticated session to the opening handshake, a hostile web page may be able to start that connection in the user&rsquo;s browser unless the server checks which site initiated it.</p> <p>That creates a cross-site trust problem. The user can be signed in to <code>app.example</code>, visit another site in a separate tab, and still have the browser make requests that involve credentials associated with <code>app.example</code>. A WebSocket server that accepts the handshake based only on those credentials can give an untrusted page access to an authenticated channel.</p>