WebSocket connections are a cornerstone of modern real-time web applications, but their security model is often misunderstood. Cross-site WebSocket hijacking (CSWSH) occurs when a malicious website initiates a WebSocket connection to a vulnerable server using the victim's existing authentication cookies. Unlike traditional CSRF, which targets HTTP requests, CSWSH exploits the fact that WebSocket handshakes are often not protected by origin validation or CSRF tokens. Once the connection is established, the attacker can read and send messages, potentially stealing sensitive data or performing actions on behalf of the user. Mitigation requires strict origin checking on the server side, validating the Sec-WebSocket-Key, and using authentication mechanisms that are not automatically sent by browsers, such as tokens in the handshake. This topic is evergreen because WebSocket adoption continues to grow across chat, gaming, and collaborative tools, making it a prime target for attackers. Developers should treat WebSocket endpoints with the same rigor as any authenticated API.
Cross-site WebSocket hijacking (CSWSH) is a critical but under-discussed web security flaw that lets malicious sites establish WebSocket connections on behalf of authenticated users. This signal highlights the attack mechanics and the need for origin checks and CSRF-like protections on WebSocket handshakes. It matters because modern real-time apps increasingly rely on WebSockets, expanding the attack surface.