Real Time Updates medium
Cross-Site WebSocket Hijacking (CSWSH) is a vulnerability where an attacker's site connects to your WebSocket server using the victim's cookies. How do you prevent this?
- A Validate the `Origin` header during the initial HTTP Upgrade handshake.
- B Use SSL (WSS) everywhere.
- C Disable Cookies.
- D Use a random port number.
Answer: A. Validate the `Origin` header during the initial HTTP Upgrade handshake.
Just like CSRF, the browser automatically sends cookies (session IDs) with the handshake request even if it originates from `evil.com`. The server must check `Origin: https://trustedsite.com` and reject mismatches.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- When a mobile app is closed/backgrounded, it cannot keep a WebSocket open. How does it receive real-time alerts (like 'New Message')?
- For a human user, what is generally considered the maximum acceptable latency for an interaction to feel 'Real-Time' (e.g., typing in a Google Doc)?
- If you want to update a news feed on a website every time a new article is published, what is the simplest (but least efficient) 'Real-Time' technique?
- In a persistent real-time connection, what is the purpose of a 'Heartbeat' or 'Ping/Pong' message?
- Why is Short Polling considered 'Chatty'?
- Server-Sent Events (SSE) are ideal for which type of real-time application?