在 js 文件中建立 WebSocket 连接是否危险？

Question

So, basically, I have this code:

let socket = new WebSocket('ws://localhost:8080/server.php');

socket.onopen = () => {
    console.log('connection established !');
}

I use this code to establish a connection for a Real-Time Quiz. But after going to the Sources page of my inspector, I can see the whole javascript code in my browser, including ws://localhost:8080/server.php . Is it dangerous to show it (unintentionally)? If someones creates a script and puts in it the same url (not localhost, it's just an example), can he receive/send data to the server?

Answer 1

yes,it is dangerous. u can:

1. verify the client http request header for example 'Origin'. make sure the client website is the right client website.

2. use a TSL websocket service, visit to the server over SSL. So the protocol is changing to: wss://

3. give the client a request token, put this token in header or in post data, the server verify this token.

4. check the request times of a client in limited time. make sure a specific client won't request too frequently