Security¶

WebSockets¶

WebSockets start out life as a HTTP request, including all the cookies and headers, and so you can use the standard Authentication code in order to grab current sessions and check user IDs.

There is also a risk of cross-site request forgery (CSRF) with WebSockets though, as they can be initiated from any site on the internet to your domain, and will still have the user’s cookies and session from your site. If you serve private data down the socket, you should restrict the sites which are allowed to open sockets to you.

This is done via the channels.security.websocket package, and the two ASGI middlewares it contains, OriginValidator and AllowedHostsOriginValidator.

OriginValidator lets you restrict the valid options for the Origin header that is sent with every WebSocket to say where it comes from. Just wrap it around your WebSocket application code like this, and pass it a list of valid domains as the second argument. You can pass only a single domain (for example, .allowed-domain.com) or a full origin, in the format scheme://domain[:port] (for example, http://allowed-domain.com:80). Port is optional, but recommended:

from channels.security.websocket import OriginValidator

application = ProtocolTypeRouter({

    "websocket": OriginValidator(
        AuthMiddlewareStack(
            URLRouter([
                ...
            ])
        ),
        [".goodsite.com", "http://.goodsite.com:80", "http://other.site.com"],
    ),
})

Note: If you want to resolve any domain, then use the origin *.

Often, the set of domains you want to restrict to is the same as the Django ALLOWED_HOSTS setting, which performs a similar security check for the Host header, and so AllowedHostsOriginValidator lets you use this setting without having to re-declare the list:

from channels.security.websocket import AllowedHostsOriginValidator

application = ProtocolTypeRouter({

    "websocket": AllowedHostsOriginValidator(
        AuthMiddlewareStack(
            URLRouter([
                ...
            ])
        ),
    ),
})

AllowedHostsOriginValidator will also automatically allow local connections through if the site is in DEBUG mode, much like Django’s host validation.