WebSocket

WebSocket
source
Name	WebSocket
Developer	IETF, W3C
Introduced	December 2011
Based on	TCP, HTTP
Osi layer	Application layer
Port	80, 443
Rfc	RFC 6455

WebSocket. It is a computer communications protocol, providing full-duplex communication channels over a single TCP connection. The protocol was standardized by the IETF as RFC 6455 in 2011, with the WebSocket API being standardized by the W3C. This technology enables interactive communication between a user's web browser and a server, facilitating real-time data transfer without the overhead of repeated HTTP polling.

Overview

The WebSocket protocol represents a significant advancement over traditional HTTP request-response models, allowing for persistent, bidirectional communication. It was designed to be implemented in web browsers and web servers but is also usable by any client or server application. The initial connection is established via a standard HTTP upgrade request, after which the protocol switches to a binary or text message framing mechanism. This design is integral to modern real-time web applications, reducing latency and bandwidth consumption compared to techniques like long polling or Server-Sent Events.

Technical specifications

The core specification is defined in IETF's RFC 6455, which outlines the wire protocol for full-duplex communication. The protocol operates over TCP on ports 80 and 443, facilitating traversal through most firewalls and proxy servers. Data is transmitted in a series of frames, which can contain either UTF-8 text or binary data. The framing includes a minimal header, masking for client-to-server frames as a security measure, and support for fragmentation. The W3C separately defines the WebSocket API in the HTML Living Standard, which provides the interface for JavaScript in the web browser to utilize the protocol.

Protocol handshake

To establish a WebSocket connection, the client initiates a handshake by sending a standard HTTP request with an `Upgrade` header. This request is often directed to a web server like Apache HTTP Server or Nginx. The server, if it supports the protocol, responds with an HTTP 101 status code, switching protocols. The handshake includes a key-exchange using a Base64-encoded nonce and a globally unique identifier defined in the RFC, ensuring the connection is not misinterpreted by intermediaries. This process allows the connection to be established over the same ports used by HTTPS and standard HTTP traffic.

Use cases and applications

WebSocket is fundamental to applications requiring low-latency, real-time interactivity. It powers features in major platforms like the collaborative editing in Google Docs, live notifications in Facebook, and real-time trading interfaces in financial services. The protocol is extensively used in multiplayer browser games, live sports updates, and chat applications. Furthermore, it enables real-time data visualization in dashboards for systems monitoring, and is a backbone technology for the Internet of Things, allowing devices to maintain constant communication with cloud platforms like Amazon Web Services or Microsoft Azure.

Security considerations

While the protocol itself includes frame masking to prevent cache poisoning in intermediaries, securing WebSocket connections primarily relies on using the `wss://` scheme, which tunnels the protocol over TLS, analogous to HTTPS. Developers must implement origin-based authentication to prevent Cross-Site WebSocket Hijacking attacks, similar to Cross-site request forgery. Input validation and message size limits are critical, as open connections can be exploited for resource exhaustion attacks. The Open Web Application Security Project provides guidelines for mitigating these risks in real-time applications.

Comparison with other protocols

Unlike the traditional HTTP protocol, which is stateless and half-duplex, WebSocket provides a stateful, full-duplex channel. Compared to Server-Sent Events, which only allows server-to-client push, WebSocket enables bidirectional communication. While technologies like long polling can simulate real-time updates, they incur higher latency and server overhead. For non-web scenarios, protocols like MQTT are optimized for constrained Internet of Things devices, whereas WebSocket is more general-purpose. The WebRTC protocol is designed for peer-to-peer media streaming, often using a WebSocket server for initial signaling.

Category:Application layer protocols Category:Internet standards Category:World Wide Web Consortium standards