Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

initial trim of websocket section #1909

Merged
merged 5 commits into from
Apr 21, 2024
Merged

initial trim of websocket section #1909

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6b08f19
intial trim of websocket section
tghosth Mar 20, 2024
86091a8
Fix linting issue
tghosth Mar 20, 2024
2bbc995
Clarify 13.5.2
tghosth Mar 21, 2024
402bc55
Fix numbering
tghosth Apr 18, 2024
2deb291
Updated 13.5.4 as per #1908 (#1936)
ryarmst Apr 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions 5.0/en/0x21-V13-API.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,9 @@ Note: Due to issues with XXE attacks against DTDs, DTD validation should not be
| # | Description | L1 | L2 | L3 | CWE |
| :---: | :--- | :---: | :---: | :---: | :---: |
| **13.5.1** | [ADDED] Verify that WebSocket Secure (wss) is used for all WebSocket connections. | ✓ | ✓ | ✓ | 319 |
| **13.5.2** | [ADDED] Verify that, during the initial HTTP WebSocket handshake, the Origin header is checked against an allow list of authorized origins. | ✓ | ✓ | ✓ | 346 |
| **13.5.3** | [ADDED] Verify that rate limiting is in place for WebSocket messages. | ✓ | ✓ | ✓ | 770 |
| **13.5.4** | [ADDED] Verify that tokens possess at least 128 bits of entropy and are generated using approved cryptographic algorithms if session or channel tokens specific to WebSockets are being used. | ✓ | ✓ | ✓ | 331 |
| **13.5.5** | [ADDED] Verify that the tokens are initially obtained from a response to secure POST request only, and are not sent by the server through the WebSocket connection if session or channel tokens specific to WebSockets are being used. | ✓ | ✓ | ✓ | 319 |
| **13.5.6** | [ADDED] Verify that authentication is done before opening the WebSocket connection if only authenticated users should be able to use WebSockets. | ✓ | ✓ | ✓ | 306 |
| **13.5.2** | [ADDED] Verify that, during the initial HTTP WebSocket handshake, the Origin header is checked against a list of origins allowed for the application. | ✓ | ✓ | ✓ | 346 |
| **13.5.3** | [ADDED] Verify that, if the application's standard session management cannot be used, dedicated tokens are being used for this which comply with the relevant Session Management security requirements. | ✓ | ✓ | ✓ | 331 |
| **13.5.4** | [ADDED] Verify that dedicated WebSocket session management tokens are initially obtained or validated through the previously authenticated HTTPS session when transitioning an existing HTTPS session to a WebSocket channel. | ✓ | ✓ | ✓ | 319 |

## References

Expand Down
Loading