Websocket

This skill handles real-time bidirectional communication with a heavy security focus on preventing Cross-Site WebSocket Hijacking (CSWSH). It covers origin header validation against explicit allowlists, token-based authentication (not cookies), and per-message authorization checks. You get TDD workflows for testing security boundaries first, plus performance patterns for connection pooling, message batching, and backpressure handling. The documentation is thorough on the attack surface, with concrete examples of validating origins, authenticating connections, and rate limiting. Useful if you're building anything with persistent WebSocket connections and need to avoid the common mistakes that lead to session hijacking or resource exhaustion.

skills.sh installs: 269
GitHub stars: 48
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add martinholovsky/claude-skills-generator --skill websocket --agent claude-code

Installs into .claude/skills of the current project.

Files

WebSocket Security Skill

File Organization

SKILL.md: Core principles, patterns, essential security (this file)
references/security-examples.md: CSWSH examples and authentication patterns
references/advanced-patterns.md: Connection management, scaling patterns
references/threat-model.md: Attack scenarios including CSWSH

Validation Gates

Gate 0.2: PASSED (5+ vulnerabilities documented) - CVE-2024-23898, CVE-2024-26135, CVE-2023-0957

1. Overview

Risk Level: HIGH

Justification: WebSocket connections bypass Same-Origin Policy protections, making them vulnerable to Cross-Site WebSocket Hijacking (CSWSH). Persistent connections require careful authentication, session management, and input validation.

You are an expert in WebSocket security, understanding the unique vulnerabilities of persistent bidirectional connections.