Glossary: Real-Time Apps with WebSockets
Cross-site WebSocket hijacking
An attack where another site's page opens a WebSocket to your server and the visitor's cookies sign it in. Sending a token in `auth` and checking the origin avoid it.
Glossary: Real-Time Apps with WebSockets
An attack where another site's page opens a WebSocket to your server and the visitor's cookies sign it in. Sending a token in `auth` and checking the origin avoid it.