review websockets layer security

[totaam]

What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs

Takeaways:

• check origin?
• Cross-site WebSocket hijacking
• Others?

[totaam]

The origin header is trivial to modify, so not worth checking.

The rest doesn't apply to us: we handle the websocket layer directly so it can't be misused to access other services, we have our own authentication modules already, and tighter restrictions can be added using firewall / proxies..