Websocket 对于网页之间的通信是否更安全？
这可能听起来很天真，但我真的会发现描述性答案很有帮助。
所以，我的问题是：
我可以使用 Firebug 查看我访问的任何网站发出的 AJAX 请求。那么，如果网站选择使用 Websockets，我将无法检查客户端和服务器之间的相同通信，我这样说对吗？换句话说，这是否使其更安全？
This might sound really naive but I would really find a descriptive answer helpful.
So, my question is this:
I can use Firebug to look at AJAX requests made from any website I visit. So, am I right in saying that I wouldn't be able to examine the same communication between the client and the server if the website choses to use Websockets? In other words, does this make it more secure?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
不，一点也不。仅仅因为浏览器（尚）没有显示 WebSocket 流量的工具，并不意味着它会更安全。例如，您始终可以运行数据包嗅探器来监控流量。
No. Not at all. Just because the browser does not (yet) have a tool to show WebSocket traffic, doesn't make it any more secure. You can always run a packet sniffer to monitor the traffic, for example.
不，因为除了浏览器内置工具之外，还有其他方法可以读取您的流量。
尝试一下：安装并运行 Wireshark，您将能够看到通过 Websockets 发送和接收的所有数据包。
No, because there will be other ways beside the browser-build in tools to read your traffic.
Have a try: Install and run Wireshark and you will be able to see all packets you send and receive via Websockets.
取决于应用程序。如果您完全使用 Ajax，而无需重新加载数据文档，那么我认为 websockets 将为数据请求提供更好的身份验证，而不是关于连接劫持的 cookie 会话。当然，考虑到您正在使用 SSL。
Depends on the application. If you are fully Ajax without reloading the document for data then I would think websockets would provide a better authentication for data requests then a cookie session in regards to connection hijack. Given that you are using SSL of course.
WebSockets 具有未加密 (ws://) 和加密模式 (wss://)。这类似于 HTTP 和 HTTPS。 WebSockets 协议有效负载只是 UTF-8 编码。从网络嗅探的角度来看，使用 WebSocket 没有任何优势（对所有敏感的内容使用 wss 和 HTTPS）。从浏览器的角度来看，使用 WebSocket 来保证安全并没有任何好处。知识渊博的用户可以检查（和修改）浏览器中运行的任何内容。现在用于检查 HTTP/AJAX 请求的工具恰好更好。
WebSockets has both an unencrypted (ws://) and encrypted mode (wss://). This is analogous to HTTP and HTTPS. WebSockets protocol payload is simply UTF-8 encoded. From a network sniffing perspective there is no advantage to using WebSockets (use wss and HTTPS for everything at all sensitive). From the browser perspective there is no benefit to using WebSockets for security. Anything running in the browser can be examined (and modified) by a sufficiently knowledgeable user. The tools for examining HTTP/AJAX requests just happen to be better right now.