Question

Sorry, web noob here and I have a few questions:

1. What exactly do “web sockets” do? Are they connecting the client to a socket or are they making the server connect to some socket?
2. It’s supposedly a security risk to allow the client to connect to any other socket. What kind of risks are there?

Answer 1

Web sockets allow persistent, two-way connections between the client and the server. The server can “push” data to the client and vice-versa. This is as opposed to a single AJAX request which can only push data once from client to server and receive one response. These connections can be insecure, depending on how data is used on the server. Data sent from the client runs through a script of yours, so you control what happens. Needless to say, it would be stupid to, say, execute or write to disk whatever is received from the client. As long as you check that it is what you expect it to be, you should be okay.