Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added check to insecure websocket #140

Open
wants to merge 12 commits into
base: master
Choose a base branch
from

Conversation

pkalyankumar1010
Copy link

@pkalyankumar1010 pkalyankumar1010 commented Feb 27, 2025

Insecure WebSocket Detected , Use Secure WebSocket
Your code is using an insecure WebSocket (ws://), which transmits data unencrypted, making it vulnerable to man-in-the-middle (MITM) attacks and eavesdropping.

Problem :

  • const socket = new WebSocket({port : 8080});
  • Data is sent in plain text over the network.
  • Attackers can intercept, modify, or inject messages.
  • Modern browsers may block ws:// connections on HTTPS websites due to security risks.

Solution: Use wss://

  • To secure the WebSocket connection, switch to wss://, which encrypts the communication using TLS/SSL, just like HTTPS:
  • import { createServer } from "https";
  • const server = createServer({ cert: ..., key: ... });
  • const wss4 = new WebSocketServer({ server });
  • Ensures end-to-end encryption.
  • Protects against MITM attacks.
  • Works seamlessly with HTTPS websites.

Copy link

vercel bot commented Feb 27, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment
Name Status Preview Comments Updated (UTC)
globstar ⬜️ Ignored (Inspect) Visit Preview Feb 27, 2025 0:28am

@@ -0,0 +1,38 @@
language: js
name: avoid_ws_with_just_port
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This checker looks similar to the one in #141. Can we merge both of them?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants