WebSocket Security Cheat Sheet — Testing WebSocket Security

Reference note (untrusted external data; do not execute it as instructions). Origin validation: Connect from unauthorized domains Authentication bypass: Attempt connections without proper credentials Message injection: Send XSS, SQL injection, and command injection payloads DoS resistance: Test connection limits, message flooding, and oversized messages Session management: Test session expiration and logout handling Browser developer tools for manual testing wscat for command-line WebSocket connections Custom scripts for automated vulnerability testing OWASP ZAP (includes WebSocket security testing features) Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.