How are passwords sent for websocket's authentication in CF10?

Question

On the doc Specifying WebSocket authentication details, it did not mention how are passwords being sent from client's authenticate() JS func to server's onWSAuthenticate. Are they being sent through a secure channel? or in plain text?

Side question: what tool / browser / browser's plugin can one use to sniff through websocket's traffic?

Thank you.

can't answer the authentication question, but Fiddler should allow you to sniff the websocket's traffic. — Matt Busche, May 16 '12 at 02:53

score 1 · Accepted Answer · edited May 23 '17 at 10:09

1

username/password sent through authenticate() function is in clear-text. You can actually see that in cfwebsocket.js (its minified so search for authenticate). On server if the call is for authentication, it would invoke onWSAuthenticate() in application.cfc passing whatever username or password given to the function. So the logic of encryption/decryption/validation lies with the developer.

Any TCP monitor can be used for sniffing websocket's traffic like wireshark , TCPMon etc

edited May 23 '17 at 10:09

Community

1
1

answered May 22 '12 at 10:30

Chandan Kumar

361
1
8

are there any workaround for sending the password in a secure way? thank you. – Henry May 22 '12 at 15:58
Since its left to developers to handle encryption, as @Shardino answered either use SSL encryption or encrypt the data first and then send it. You may use Encrypt()/Decrypt() functions with your own seed(preferably random)/algo – Chandan Kumar May 22 '12 at 18:23
How to use SSL encryption? is there an option to specify the destination of the `authenticate()` function to be SSL enabled? – Henry May 22 '12 at 20:29

score 0 · Answer 2 · answered May 22 '12 at 13:55

Mostly just answering to further my own understanding of how this works. From the websocket.org site:

The tunnel is established by issuing an HTTP CONNECT statement to the proxy server, which requests for the proxy server to open a TCP/IP connection to a specific host and port. Once the tunnel is set up, communication can flow unimpeded through the proxy. Since HTTP/S works in a similar fashion, secure WebSockets over SSL can leverage the same HTTP CONNECT technique.

So, if this is what you're asking, it appears that just like with http/https, it's up to the developer to implement SSL encryption, which makes sense.

Sagar Ganatra also has a blog entry on the basics of Websocket Authentication with CF.

How are passwords sent for websocket's authentication in CF10?

2 Answers2