Can I safely rely on a WebSocket connection after initial handshake?

user_4216654 0
Viewed 1129

The typical scenario:

  1. The client sends his credentials to the server in a POST request using HTTPS.

  2. The server verifies that the credentials are the right ones and authenticates the user. Thus it returns a JWT (JSON Web Token) to the client.

  3. The client opens a non secured WebSocket connection (ws://). So the client and the server now have a channel to exchange data easily (the exact reasons don't matter here).

  4. The user sends any kind of requests to the server through the WebSocket along with the JWT, so the server can verify that these requests are legit.

  5. The server uses the WebSocket channel to return the data asked by the user after it successfully verified the JWT for each request.

Since we used HTTPS, we assume the JWT was not stolen when it was issued (HTTPS could be defeated but let's assume it's sane for our purpose).

The fact that we use a non secured WebSocket means that someone could sniff the traffic of the WebSocket channel and steal the JWT in a heartbeat. So we use a WebSocket Secure (wss://) instead and apply the same previous scenario.

Now that we are using a WebSocket Secure, do we need to keep sending the JWT in each request we make to the server when we use the WSS channel to do so? Or is the WebSocket Secure channel secured enough so both the server and the client are 100% sure (as long as TLS is not defeated) that this channel is legit?

In other words: once a WSS channel has been safely established, can we trust it? (until the connection is closed obviously)

I don't really understand how a WSS connection is established and how it works once it has been established. My understanding is: the critical part is the handshake, and once the handshake is done you can safely rely on the WSS channel (because it prevents MITM attacks using TLS, which WS doesn't do).

I read a lot of stuff these last days about all this but some concepts are still unclear. Any help will be greatly appreciated!

ssl websocket
1 Answers

Websockets use a persistent TCP/IP connection.

Using wss is similar to using the HTTPS, which means that once the SSL/TLS handshake is complete, all Websocket data is "wrapped" (usually encoded) in TLS packages.

Assuming the TLS/SSL connection is secure, the Websocket connection will remain secure and could be (and probably should be) authenticated only once.

Hence, there's no reason to keep sending the JWT over and over again. It's a better solution to use the connection's persistent state in order to "assign" a user to the connection.

Side-Note: Although insecure, it would be better to send the JWT once even when using Websocket connection "in the clear" (ws://), since there are less opportunities to sniff out the JWT.

user_40250950
Related