CODEWITHSUNDEEP
securitysessionauthenticationwebsocket
inlair
inlair

Reputation: 21

How to make the safest Websocket Authentication

I have seen this question answered a few times, but I have a very specific problem with it.

I am currently making a game, where a HTML5 programm is talking to a C++ programm on the server side. The game does also include matches with valuable prices and therefore the low latency between the client and the server as well as the security should be as high priority.

And that leads to my question: Is it safe enough to authenticate a websocket session (TLS encrypted) a single time when it is started or should I send the SESSIONID with every message send form the client to the server?

Upvotes: 2

Views: 356

Answers (1)

moka
moka

Reputation: 23053

This question is very opinion based, and does not apply to the nature of questions of StackOverflow.

Here is my opinion:

WebSockets protocol is implemented on top of TCP network layer protocol which is connection based. So that means that connection is established and then persisted until it is closed by client or server. Interceptions in between are very unlikely possible.

After TCP connection is established WebSockets will send HTTP headers from client, just like any other HTTP request would do, but will not close connection, and wait for response from server, which is if everything "fine" header for approving HTTP protocol upgrade to WebSockets communication. Since then WebSockets are valid to be used on client and server side for communication. Since TCP connects it is persistent connection. So sending session for every request - is pointless, as it is sent once connection is established.

So no, it is not a good idea to send session details on every message as just pointless. You better make sure that restoring your session is secure process, and just obtaining cookies of a client - will not allow to connect as another user.

Upvotes: 4

Related Questions