6

I have been trying to setup a server where users can send sign in using websockets, but I don't want to do this using ws. I want to be able turn on wss without having https. Sadly, there aren't any options to do this. And so the question is how would one do this on the client side without using https protocol.

Kitanga Nday
  • 3,517
  • 2
  • 17
  • 29

2 Answers2

12

Yes, this is possible. To do this, pass your websocket URL to the socket.io client directly, like this:

var socket = io('wss://example.com/');

Note that the reverse is not possible: while there's nothing to prevent HTTP pages from creating WSS connections, most browsers today block any WS connection from an HTTPS page to enforce the heightened security.

I would also caution that a websocket opened over WSS is still no more secure than the page it originated from. If you're using WSS for its security benefits, be advised that all that security could be for naught if an attacker overrides your page at the time that it's loaded (which HTTPS would prevent).

Brilliand
  • 13,404
  • 6
  • 46
  • 58
  • OK, now I have an issue, I don't know whom to give as the answer, both your answers sound right, but my lack of knowledge on this topic limits me in making a right choice. – Kitanga Nday Nov 16 '17 at 23:41
  • 4
    @KitangaNday I suggest accepting Margaret's answer, because she answered what actually applies to your situation: You cannot have WSS without an SSL cert. My answer is technically correct, but useless to you. – Brilliand Nov 17 '17 at 23:19
5

From the Websocket protocol specification:

A wss URI identifies a WebSocket server and resource name, and indicates that traffic over that connection is to be protected via TLS (including standard benefits of TLS such as data confidentiality and integrity, and endpoint authentication).

Emphasis mine

Now you can understand the absurdity of your request: wss is https.
Of course the terminology is wrong (https is a different protocol than wss) but the bottom of the line is that both are simply the version of their respective TCP plain protocols (http and ws) over TLS.

So the answer is no.

As a matter of fact security is a complex thing.
Very experienced programmers refrain from inventing or exploring new ways and, based on the kind of question you asked, you don't appear to have much expertise this field.

So it's better to do things as best-practices say, it they say to use "https" use "https".

Starting studying security seriously (or hiring a contractor) is advised, inventing new ways to perform secure authentication is not, unless you have a PhD in abstract algebra and several years of experience in developing cryptographic schemes.

Community
  • 1
  • 1
Margaret Bloom
  • 41,768
  • 5
  • 78
  • 124
  • 6
    Disagree: while https and wss are closely related and need to be used together to get their security benefits, there is in theory no reason it shouldn't be possible to use only one or the other, and in fact I just encountered a use case where it's useful (to debug errors that might be caused by a wss library). For the asker's request, I could imagine a scenario where the http page is secured via other means (i.e. being served from localhost). Understanding the cryptographic algorithm in use is hard, but understanding which parts of your site are or aren't being secured by it is very simple. – Brilliand Sep 07 '17 at 22:08
  • 1
    @Brilliand Maybe we are seeing the question in different ways because there is no room for interpretation here: wss **is** https. So you have to setup the whole https machinery to use it. Even in your answer, you are using https. The OP is talking about *setting up* a server, not about *mixed content* – Margaret Bloom Sep 08 '17 at 06:07
  • 2
    Hmm, that is a reasonable interpretation. But as you said, the terminology is wrong: *https* and *wss* are separate things, that both depend on SSL/TLS (which is the hard part). I assumed that he made no terminology error, but you're probably right that what he really wants to avoid is the SSL cert. – Brilliand Sep 08 '17 at 09:00
  • 2
    @Brilliand Yep, that's it, I just wanted to skip SSL Certs. I decided to just switch to https. Using Firebase Host, it's a great service and they give a free SSL Cert. – Kitanga Nday Nov 16 '17 at 23:38