Insecure WebSocket usage detected (use wss instead of ws)

[sourcery-ai]

A security analysis tool (Sourcery / opengrep) has flagged an insecure WebSocket usage in the JavaScript codebase:

security (javascript.lang.security.detect-insecure-websocket): Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.

This indicates that at least one WebSocket connection is being established using the non-secure ws:// protocol instead of wss://. Using ws:// can expose data in transit to interception or manipulation, especially when the application is served over HTTPS.

Issue

• One or more JavaScript files are creating WebSocket connections via ws://.
• This is a potential security vulnerability, particularly in production environments or anywhere sensitive data may be transmitted.

Expected Behavior

• All WebSocket connections should use the secure wss:// protocol.
• WebSocket endpoints should be configured to support TLS.

Suggested Fix

1. Locate all instances of new WebSocket('ws://...') or equivalent WebSocket client code.
2. Update these URLs to use wss:// instead of ws://, for example:

   // Before
   const socket = new WebSocket('ws://example.com/socket');
   
   // After
   const socket = new WebSocket('wss://example.com/socket');

3. Ensure the backend WebSocket server is configured with TLS and reachable via wss://.
4. If local development requires ws://, consider:
   • Using environment-based configuration (e.g., WS_URL env var) so production always uses wss://.
   • Adding comments/config to clearly separate dev and prod behavior.

Action Items

• Identify all insecure WebSocket usages (ws://) in the repository.
• Update them to wss:// and verify connectivity with the secure endpoint.
• Confirm that the WebSocket server supports TLS and is properly configured.
• Add tests or automated checks (linting/static analysis) to prevent reintroduction of insecure WebSocket URLs.

Source of detection: opengrep / sourcery-ai security check.

---

I created this issue for @Its4Nik from #132 (comment).

Tips and commands

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.