WS on HTTP vs WSS on HTTPS

by

“wss works on both http and https” ??? This is a strange phrase.

wss is secure only because it means “WebSocket protocol over https“. WebSocket protocol itself is not secure. There is no Secure WebSocket protocol, but there are just “WebSocket protocol over http” and “WebSocket protocol over https”. See also this answer.

As the author of nv-websocket-client (WebSocket client library for Java), I also doubt the phrase “if the HTML/JavaScript that opens the secure WebSocket connection comes over non-secure HTTP, the WebSocket connection is still secure” in the answer by oberstet.

Read RFC 6455 (The WebSocket Protocol) to reach the right answer. To become a true engineer, don’t avoid reading RFCs. Only searching technical blogs and StackOverflow for answers will never bring you to the right place.

More Related Contents:

  1. How to redirect all HTTP requests to HTTPS
  2. Is HTTP header Referer sent when going to a http page from a https page?
  3. How to redirect all HTTP requests to HTTPS using .htaccess rules?
  4. Are HTTP cookies port specific?
  5. Are querystring parameters secure in HTTPS (HTTP + SSL)? [duplicate]
  6. How to allow http content within an iframe on a https site [duplicate]
  7. Will web browsers cache content over https
  8. Why am I suddenly getting a “Blocked loading mixed active content” issue in Firefox?
  9. Are HTTPS headers encrypted?
  10. With HTTPS, are the URL and the request headers protected as the request body is?
  11. Is it safe to put a jwt into the url as a query parameter of a GET request?
  12. Username and password in https url
  13. If you use HTTPS will your URL params will be safe from sniffing? [duplicate]
  14. Should I hash the password before sending it to the server side?
  15. https URL with token parameter : how secure is it?
  16. Is it secure to submit from a HTTP form to HTTPS?
  17. SSL Error: unable to get local issuer certificate
  18. curl – Is data encrypted when using the –insecure option?
  19. Is it OK to return a HTTP 401 for a non existent resource instead of 404 to prevent information disclosure?
  20. Why not use HTTPS for everything?
  21. How to send password securely via HTTP using Javascript in absence of HTTPS?
  22. Why Does OAuth v2 Have Both Access and Refresh Tokens?
  23. How to restrict Firebase data modification?
  24. Why is security through obscurity a bad idea? [closed]
  25. Allowing Java to use an untrusted certificate for SSL/HTTPS connection
  26. Symfony2 extending DefaultAuthenticationSuccessHandler
  27. md5 decoding. How they do it?
  28. Correctly switching between HTTP and HTTPS using .htaccess
  29. Best practices for server-side handling of JWT tokens [closed]
  30. How do I tell WCF to skip verification of the certificate?

Leave a Comment