Security aspects of full-duplex web interactions and WebSockets

Integrating full-duplex low-latency communication middleware inside an HTTP based client-server interaction enables the development of powerful and highly-interactive web applications. Among the existing client-server communication protocols, there is WebSockets that allows the browser and the server backend to open a lively session interaction independent from the main HTTP application communication. There are different implementations of this full-duplex protocol, though per se, they do not offer the security protections required in cyber-physical systems (CPS). As a result, low-latency comes at the price of explicitly adding the needed security hooks to protect the application. This paper contributes an analysis of WebSockets technology from the point of view of its architecture and vulnerabilities and its applicability to CPS. We present the some selected implementations of the protocol that have become de-facto standard implementations given their broad usage; and we describe the vulnerabilities that they integrate -given their architecture- and how to overcome them. The paper provides an exemplification of a step by step communication between server and client on a full duplex WebSocket communication and shows how the associated vulnerabilities are exploited in a real use case scenario.