Is it possible to force socket.io to use wss instead of ws, without having to change to https?

javascript sockets security socket.io wss
Kitanga Nday picture Kitanga Nday · Jan 2, 2017 · Viewed 16.6k times · Source

I have been trying to setup a server where users can send sign in using websockets, but I don't want to do this using ws. I want to be able turn on wss without having https. Sadly, there aren't any options to do this. And so the question is how would one do this on the client side without using https protocol.

Answer

Brilliand picture Brilliand · Sep 8, 2017

Yes, this is possible. To do this, pass your websocket URL to the socket.io client directly, like this:

var socket = io('wss://example.com/');

Note that the reverse is not possible: while there's nothing to prevent HTTP pages from creating WSS connections, most browsers today block any WS connection from an HTTPS page to enforce the heightened security.

I would also caution that a websocket opened over WSS is still no more secure than the page it originated from. If you're using WSS for its security benefits, be advised that all that security could be for naught if an attacker overrides your page at the time that it's loaded (which HTTPS would prevent).

Related questions

Client on node: Uncaught ReferenceError: require is not defined

So, I am writing an application with the node/express + jade combo. I have client.js, which is loaded on the client. In that file I have code that calls functions from other JavaScript files. My attempt was to use …

Read More
Connecting to TCP Socket from browser using javascript

I have a vb.net application that opens a socket and listens on it. I need to communicate via this socket to that application using a javascript running on a browser. That is i need to send some data on …

Read More
WebSocket connection failed: Error during WebSocket handshake: Unexpected response code: 400

I am trying to integrate Socket.io with Angular and I'm having difficulties making a connection from the client-side to the server. I've looked through other related questions but my issue is happening locally, so there's no web server in …

Read More