WebSocket Security Checklist

The same risks as REST, plus a few nobody checks.

WebSocket endpoints are frequently absent from security reviews scoped around REST/HTTP APIs, despite carrying analogous — and in some cases distinct — risks: cross-site WebSocket hijacking via missing Origin validation, unbounded message rate and size, and long-lived connections that never re-verify authorization after the initial handshake. This checklist covers both the risks WebSocket shares with any input surface (injection, authentication) and the ones specific to persistent connections (connection limits, message rate limiting, periodic re-authentication).

• →Weights Origin header validation heavily — the check that prevents cross-site WebSocket hijacking
• →Covers per-connection message rate limiting and concurrent connection caps, unique to persistent connections
• →Flags long-lived connections that never re-verify authorization after the initial handshake
• →Treats incoming socket messages with the same validation scrutiny as any REST request body
• →Watermarked by Cikal Studio Labs · Works on any device, no install required