domains / families / security / testing-websocket-api-security

testing-websocket-api-security

separate

Tests WebSocket API implementations for missing upgrade-handshake authentication,

When to use

• Assessing real-time communication APIs that use WebSocket (ws://) or Secure WebSocket (wss://) protocols
• Testing for Cross-Site WebSocket Hijacking (CSWSH) where an attacker's page connects to a legitimate WebSocket server
• Evaluating authentication and authorization enforcement on WebSocket connections and messages
• Testing input validation on WebSocket message payloads for injection vulnerabilities
• Assessing WebSocket implementations for denial-of-service through message flooding or oversized frames

When not to use

• Use without written authorization

Skill page

Source