WebSocket Hijacking
HighWeb Application SecurityA01:2021 – Broken Access Control
WebSocket connections lacking proper origin validation, authentication, or encryption allow attackers to hijack active connections, inject malicious messages, intercept sensitive data, or perform cross-site WebSocket hijacking from malicious pages.
- 1Implement strict Origin header validation on WebSocket upgrade requests immediately.
- 2Terminate any active WebSocket connections from unauthorized origins.
- 3Review WebSocket message logs for evidence of data exfiltration or injected payloads.
- 4Invalidate sessions of users whose WebSocket connections may have been hijacked.
