WebSocket IDOR / missing auth
WS /graphql subscriptions, socket.io rooms, presence channels, live-doc feeds. Auth is often a token in the first message, not the handshake.
Tags: websocket, idor, csrf
Typical severity: P2-P3
What it becomes
Subscribe to another user's channel, replay a privileged event, or skip the HTTP auth that the REST API has.
Where to look
/socket.io//graphql subscriptions/wsPusher / Ably channel names
Chains
- Mass data access — Guess channel IDs or replay another user's subscribe message.
- Stored XSS — If the client renders WS payloads as HTML, you have a stored XSS broadcast.
Notes
- CSWSH (cross-site WebSocket hijack) needs a missing Origin check plus a cookie-authenticated handshake.
- Test both the HTTP upgrade and the first application-level AUTH frame.