WebSocket Security Testing

This guide treats WebSocket and realtime application channels as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Map upgrade URLs, subprotocols, authentication, origin policy, and reconnect behavior.

2. 02

   Document message types, schemas, roles, rooms, and tenant boundaries.

3. 03

   Create designated publishers and subscribers with synthetic channels.

4. 04

   Record connection, idle, message-size, and rate limits.

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Verify upgrade and reconnect require the intended session state.

2. 02

   Check Origin and cross-site protections for browser clients.

3. 03

   Test message and channel authorization with designated roles.

4. 04

   Validate malformed and oversized messages within agreed limits.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log connection identity, channel, message type, policy outcome, and disconnect reason.
• Alert on repeated unauthorized subscriptions, malformed frames, and connection floods.
• Do not record raw sensitive message bodies by default.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Authenticate upgrades and authorize every message or subscription.
• Validate schemas and enforce size, rate, idle, and connection limits.
• Restrict browser origins and rotate expired sessions.
• Apply backpressure and observable disconnect behavior.