Use secure WebSocket (wss) instead of insecure ws connections

[sourcery-ai]

Summary

A potential security issue has been identified in the JavaScript codebase related to the use of insecure WebSocket connections. The automated analysis (Sourcery / opengrep) flagged javascript.lang.security.detect-insecure-websocket, indicating that a ws:// WebSocket is being used where wss:// (WebSocket Secure) should be used.

Details

• Tool: Sourcery / opengrep
• Rule: javascript.lang.security.detect-insecure-websocket
• Issue: Insecure WebSocket Detected
• Current behavior: At least one WebSocket connection in the code uses the non-secure ws:// protocol.
• Expected behavior: All WebSocket connections should use wss:// to ensure transport-level encryption and mitigate eavesdropping/man-in-the-middle attacks.

This may affect any feature that relies on real-time communication over WebSockets, especially in production environments or when handling sensitive data.

Impact

Using ws://:

• Leaves WebSocket traffic unencrypted on the network.
• Can expose sensitive data to network observers.
• May violate security best practices and organizational policies.

Suggested Fix

1. Locate all WebSocket initializations using ws:// (e.g., new WebSocket('ws://...')).
2. Change them to use wss:// (e.g., new WebSocket('wss://...')), ensuring the backend/server supports secure WebSockets (TLS/SSL) on the corresponding endpoint.
3. If running behind a reverse proxy (e.g., Nginx, HAProxy, Cloudflare), ensure WebSocket upgrades and TLS termination are correctly configured.
4. Confirm that any local/dev environments are updated to support wss:// or provide a clearly separated dev-only configuration.

Action Items

• Identify the file(s) and line(s) where ws:// WebSockets are used.
• Confirm the WebSocket server(s) support wss:// and have valid TLS certificates.
• Update WebSocket URLs from ws:// to wss://.
• Add tests or checks (lint/static analysis) to prevent introduction of new insecure WebSockets.
• Document the requirement to use wss:// in the project’s security or contribution guidelines.

References

• MDN Web Docs: WebSockets — https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API
• MDN on Secure WebSockets (wss://) — https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API#establishing_a_connection

---

I created this issue for @Its4Nik from #132 (comment).

Tips and commands

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.