WebSocket connections bypass many traditional HTTP security controls — they're long-lived, bidirectional, and often carry less scrutiny than REST endpoints. Security testing covers: authentication at connection establishment and message level, cross-site WebSocket hijacking, injection through WebSocket messages (XSS, command injection), authorisation enforcement per message type, origin validation, rate limiting on message volume, data validation for all incoming messages, and secure closure handling.
Technical
WebSocket Security Testing: Real-Time Communication Vulnerabilities for Australian Enterprises
WebSockets enable real-time features but bypass traditional HTTP security controls. Testing persistent connections for injection and hijacking. Guidance for AU market.