CODEWITHSUNDEEP
javascriptphphtmlcss
Okaam
Okaam

Reputation: 15

Is it dangerous to establish WebSocket connection in a js file?

So, basically, I have this code :

let socket = new WebSocket('ws://localhost:8080/server.php');

socket.onopen = () => {
    console.log('connection established !');
}

I use this code to establish a connection for a Real-Time Quiz. But after going to the Sources page of my inspector, I can see the whole javascript code in my browser, including ws://localhost:8080/server.php. Is it dangerous to show it (unintentionally) ? If someones creates a script and puts in it the same url (not localhost, it's just an example), can he receive/send data to the server ?

Upvotes: 1

Views: 95

Answers (1)

Richard Wan
Richard Wan

Reputation: 86

yes,it is dangerous. u can:

  1. verify the client http request header for example 'Origin'. make sure the client website is the right client website.

  2. use a TSL websocket service, visit to the server over SSL. So the protocol is changing to: wss://

  3. give the client a request token, put this token in header or in post data, the server verify this token.

  4. check the request times of a client in limited time. make sure a specific client won't request too frequently

Upvotes: 1

Related Questions