WebSocket attacks

When it applies

The app uses WebSockets for realtime features. They're often less-tested than HTTP and skip the authz/validation the REST API has — plus the handshake can be CSRF-able.

Why it works

The WS handshake is an HTTP request that carries cookies; if the server authenticates by cookie alone and doesn't check Origin, any site can open a socket as the victim (Cross-Site WebSocket Hijacking). And per-message authorization is frequently missing — the server trusts the connection.