websocket

The websocket skill provides guidance for implementing secure real-time bidirectional communication using WebSocket technology, with a strong focus on preventing common security vulnerabilities. WebSocket connections bypass traditional Same-Origin Policy protections, which exposes systems to risks such as Cross-Site WebSocket Hijacking (CSWSH). This skill addresses those risks by defining security principles, validation requirements, and testing practices for persistent connections. It emphasizes secure connection establishment, strict origin validation, authentication before message handling, and defensive input validation to ensure that every message received through the connection is treated as untrusted input.

The skill outlines core security capabilities required for production-grade WebSocket implementations. These include CSWSH prevention through explicit Origin header validation, token-based authentication before accepting connections, per-message authorization checks, and message format validation. It also promotes operational safeguards such as rate limiting, connection lifecycle management, idle timeouts, and resource limits like maximum message size and maximum connections per IP. The implementation workflow is based on a Test-Driven Development (TDD) approach, encouraging developers to write failing security tests first to verify boundaries such as origin validation, authentication enforcement, and message authorization.

This skill is intended for developers and teams building applications that rely on persistent real-time communication, such as dashboards, collaborative tools, or streaming data systems. It is particularly useful for backend engineers using Python frameworks that support WebSockets, including FastAPI or Starlette, and libraries such as websockets. Security-conscious teams can use this skill to implement structured validation gates, protect against known vulnerability patterns, and maintain reliable, low-latency connections while enforcing strict authentication and authorization controls.