akka/akka-http

Review potential cross-site security issue wrt Websocket

Open

#275 opened on Sep 12, 2016

View on GitHub
 (7 comments) (0 reactions) (0 assignees)Scala (598 forks)batch import
1 - triagedhelp wantedt:websocket

Repository metrics

Stars
 (1,311 stars)
PR merge metrics
 (Avg merge 1d 10h) (2 merged PRs in 30d)

Description

Issue by jrudolph Thursday Sep 24, 2015 at 09:05 GMT Originally opened as https://github.com/akka/akka/issues/18549

@fommil reminded me that browsers may not be strict enough in preventing cross-site scripting to prevent malicious sites from opening up websocket connections on the behalf of the browser user.

We need to check in which situations this can lead to problems and how to prevent insecure access (e.g. by changing the server-side Websocket API to force the developer to provide an Origin checker to accept incoming Websocket requests).

Contributor guide

Research direction
Investigate how browsers handle WebSocket origins and propose a server side Origin checker implementation for akka http. Review existing websocket API and suggest changes to enforce origin checking.
Tech stack
None
Domain
backendsecurity
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitWebSocket basicsSecurity concepts
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40