Skip to content

Commit

Permalink
Additional web socket security
Browse files Browse the repository at this point in the history
Checks that clients are authorized to receive a video stream. An
attacker could easily modify client.js to connect to a password
protected victim server otherwise.
  • Loading branch information
nick-hunter committed Dec 21, 2017
1 parent d9dbaa5 commit 2708855
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions server.py
Expand Up @@ -62,8 +62,11 @@ def on_message(self, message):

# Start an infinite loop when this is called
if message == "read_camera":
self.camera_loop = PeriodicCallback(self.loop, 10)
self.camera_loop.start()
if not args.require_login or self.get_secure_cookie(COOKIE_NAME):
self.camera_loop = PeriodicCallback(self.loop, 10)
self.camera_loop.start()
else:
print("Unauthenticated websocket request")

# Extensibility for other methods
else:
Expand Down

0 comments on commit 2708855

Please sign in to comment.