Collected research

Unveiling vulnerabilities in WebSocket APIs

What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.

Mikhail Egorov · Speaker Deck · 25 October 2019

Surveys weaknesses in WebSocket APIs: cross-site WebSocket hijacking including a null-origin variant delivered from a data URI iframe, missing authentication and object-reference checks on individual messages, and smuggling arbitrary HTTP requests to internal endpoints through reverse proxies that blindly tunnel an upgraded connection.

Record

Document

What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.

Researcher

Mikhail Egorov

Published by

Speaker Deck

Date

25 October 2019

Format

Slides

Topic

HTTP

In the archive

• Collected in the 2019 research round

Related sources

• Mikhail Egorov - What’s Wrong with WebSocket APIs? Unveiling Vulnerabilities in WebSocket APIs.

Tags

• websocket
• request-smuggling
• csrf
• idor
• auth-bypass
• reverse-proxy
• same-origin-policy
• proxy
• http
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Mikhail Egorov, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.