How does it work

• Client makes HTTP request with upgrade header
• Server accepts subprotocol and upgrades connection
• Boom, Websockets.

Demo

https://github.com/connormckelvey/ujs-websockets

Subprotocols

• No headers sent so client and server need to agree on subprotocol.
• Client can provide an array of subprotocols that the server can choose from
• Subprotocol Examples
  • XMPP, WAMP, JSON-RPC, REST variants
• Define how data is formatted (JSON, XML)
• Define when client/server should receive a response after sending a message
• Defines a namespace for backwards compatability

var connection = new WebSocket('ws://localhost:1337', 
    ['wamp', 'xmpp', ''example.com/v2]);

I Can Haz WebSockets?

Yes, with Polyfill or Fallback

• web-socket-js - Falls back to Flash Socket
• sockjs-client - Falls back to XHR-Streaming and Long Polling

• socket.io - Transports include to Flash Socket, XHR-Steaming, Long Polling, Iframe Messaging, JSONP Polling

WebSocket Security

• Use wss://  
  • encrypted with SSL/TLS and prevent MitM attacks
• Avoid tunneling other TCP services
  •  XSS attacks can lead to complete remote breaches
• Validate client input
  • SQL injection is possible over WS as in HTTP
• Validate server data
  • Use JSON.parse()
  • Never evaluate as code
  • Never apply directly to DOM (like I did in my example.)

WebSocket Security Continued

• Authenticate connections --
  • initial HTTP Ugrade request sends cookies, so use them.
  • Create expiring tokens for connections
  • Valide Origin header
    • Easily spoofed but do it anyway
• DOS Attacks --Client can open unlimited connections
  • CloudFlare supports WS
  • Don't do resource intensive stuff with WS
  • Again, Authenticate connections and deny as needed

WebSocket Issues

• Proxies and Firewalls may kill connection or Upgrade may fail
  • Enterprise proxies not up to date with WebSockets
  • Traffic doesn't loop like HTTP traffic
  • Connection header is stripped
  • Using WSS:// prevents connection from being interpreted by intermediary proxies.
  • Proxies not by default configured to handle WS but can be.

WebSocket Issues

• Keeping connections alive can be difficult
• Both Client and Server could go away 
  • Unreliable internet
  • Wireless connection may fade out
• Error handing is extremely important
  • Let user know
  • Offline mode with local storage and Sync later
• Don't know if information has been received on other side, (This is what subprotocol are for)