WebSockets
Handshake, first frame, then every subscribe. Treat it as an API with a worse auth story.
Tags: websocket, cswsh, idor
Checklist
- Find sockets: new WebSocket, socket.io, graphql-ws, SockJS, SignalR. Token in query vs cookie vs first JSON.
- Origin on the handshake: Cross-site cookie handshake without Origin check is CSWSH.
- Replay as the other user: A's subscribe as B. Channel names that are user IDs.
- First-frame auth skip: Connect without the auth frame, or with a stale token, and still receive events.
- Server HTML: If the client innerHTMLs WS payloads, you have stored XSS with a broadcast amp.
- Rate and fan-out: Can you subscribe to everyone? Can you flood a shared room?