Cross-Site Request Forgery (CSRF)

Property	Value
Language
Severity
CWE	CWE-352: Cross-Site Request Forgery (CSRF)
OWASP	A01:2021 - Broken Access Control
Confidence Level	Medium
Impact Level	Low
Likelihood Level	Low

Description

The WebSocket server does not validate the Origin header during the handshake, allowing connections from any domain. This omission makes it possible for malicious sites to establish unauthorized WebSocket connections to your server.

Impact

Without Origin checks, attackers can exploit Cross-Site Request Forgery (CSRF) to perform actions on behalf of authenticated users or leak sensitive data via unauthorized WebSocket requests. This can lead to data breaches, unauthorized operations, or abuse of application functionality.