即使我的网站使用SSL服务，我也可以强制Web套接字不使用SSL吗？

Question

I have a JavaScript client.

I have a web socket and it is trying to talk to my server.

My web app runs under https and I have used Open SSL for get my certificates.

In my C# I am using the Socket object to receive client requests.

My clients can connect but the when I try to read/parse the headers it is encrypted. (I do not know how to decrypt).

If occured to me if my web socket did not use SSL the problem would go away. But, even if I set the uri in my client to:

var url = "ws://192.168.0.9:8090/Relayer";

It is changed to:

var url = "wss://192.168.0.9:8090/Relayer";

This is my server code:

//server starting to listen

serverSocket = new Socket( AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.IP );
serverSocket.Bind( new IPEndPoint( IPAddress.Any, 8090 ) );
serverSocket.Listen( 128 );
serverSocket.BeginAccept( null, 0, OnAccept, null );


//server responding to Client Request:

private static Socket serverSocket;

private static void OnAccept(IAsyncResult result)
{
    byte[] buffer = new byte[1024];

    try
    {
        Socket client = null;
        string headerResponse = "";
        if (serverSocket != null && serverSocket.IsBound)
        {
            client = serverSocket.EndAccept(result);
            var i = client.Receive(buffer);



            //my many attempts to read the data....       

            string unicode = (Encoding.UTF8.GetString(buffer)).Substring(0, i);
            string str = Uri.UnescapeDataString(unicode);
            var outputs = System.Net.WebUtility.HtmlDecode(unicode);
        }
        if (client != null)
        {
            /* Handshaking and managing ClientSocket */
        }
    }
    catch (SocketException ex)
    {
        Logger.LogVerbose(LoggerNames.Error, ex.ToString());
    }
    finally
    {
        if (serverSocket != null && serverSocket.IsBound)
        {
            serverSocket.BeginAccept(null, 0, OnAccept, null);
        }
    }
}

So, can I FORCE my web socket not to use SSL?

Thanks

OKAY After reading stuff I understand it is not a good idea to mix http and https and ws and wss.

Any ideas to get this working using SSL/wss then that would be good :)

Answer 1

Can I force my web socket not to use SSL even though my site is served under SSL?

If your JavaScrip client follows security conventions, then the answer is no . The answer is also "it shouldn't".

There are a number of reasons for this, but the following reason is quite enough:

When a user observes that the website is encrypted, they assume that any private information they share will not be visible to third parties . This is part of the promise made by encryption . However, by allowing clear-text (unencrypted) communication after stating the site is encrypted, this promise could be broken .

This is why secure clients will not allow non-encrypted communication (ie, WebSockets, XHR, etc') within a secure website.

My clients can connect but the when I try to read/parse the headers it is encrypted. (I do not know how to decrypt).

The encrypted data should be passed through the SSL layer to be decrypted.

Often, many languages will provide an "SSL Socket" abstraction that behaves like a socket but automatically encrypts / decrypts data.

As mentioned in the comments the SslStream might be what you're looking for (see Jesse de Wit's comment).