wscheck

Documentation

Overview

Package wscheck implements a real WebSocket handshake to detect Cross-Site WebSocket Hijacking (CSWSH): a server that completes the upgrade handshake for a request bearing a forged cross-origin Origin header is not validating the Origin and may be hijackable.

Index

• func NormalizeWSURL(raw string) string
• type Result
  • func Check(wsURL string, extraHeaders map[string]string, timeout time.Duration) (*Result, error)

Functions

func NormalizeWSURL

func NormalizeWSURL(raw string) string

NormalizeWSURL converts an http(s) URL to ws(s) scheme for handshake.

Types

type Result

type Result struct {
	URL          string
	ForgedOrigin string
	Accepted     bool // server returned 101 Switching Protocols
	Detail       string
}

Result describes the outcome of a CSWSH probe.

func Check

func Check(wsURL string, extraHeaders map[string]string, timeout time.Duration) (*Result, error)

Check performs a WebSocket handshake against wsURL (ws:// or wss://, or http(s):// which is upgraded) using a forged Origin and a legitimate-looking one, and reports whether the cross-origin handshake was accepted.