1
// 短轮询：每隔一段时间主动询问
2
setInterval(async () => {
3
  const response = await fetch("/api/messages");
4
  const data = await response.json();
5
  if (data.hasNew) {
6
    updateUI(data.messages);
7
  }
8
}, 3000); // 每 3 秒轮询一次

1
GET /api/messages HTTP/1.1
2
Host: example.com
3
User-Agent: Mozilla/5.0...
4
Accept: application/json
5
Cookie: session=abc123...
6
Authorization: Bearer xxx...

1
// 长轮询：服务端持有请求直到有数据或超时
2
async function longPoll() {
3
  const response = await fetch("/api/messages?timeout=30");
4
  const data = await response.json();
5
  updateUI(data.messages);
6
  longPoll(); // 立即发起新的长轮询
7
}

1
  0                   1                   2                   3
2
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3
 +-+-+-+-+-------+-+-------------+-------------------------------+
4
 |F|R|R|R| opcode|M| Payload len |    Extended payload length    |
5
 |I|S|S|S|  (4)  |A|     (7)     |             (16/64)           |
6
 |N|V|V|V|       |S|             |   (if payload len==126/127)   |
7
 | |1|2|3|       |K|             |                               |
8
 +-+-+-+-+-------+-+-------------+ - - - - - - - - - - - - - - - +
9
 |     Extended payload length continued, if payload len == 127  |
10
 + - - - - - - - - - - - - - - - +-------------------------------+
11
 |                               |Masking-key, if MASK set to 1  |
12
 +-------------------------------+-------------------------------+
13
 | Masking-key (continued)       |          Payload Data         |
14
 +-------------------------------- - - - - - - - - - - - - - - - +

1
GET /chat HTTP/1.1
2
Host: server.example.com
3
Upgrade: websocket
4
Connection: Upgrade
5
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
6
Sec-WebSocket-Version: 13
7
Origin: http://example.com

1
HTTP/1.1 101 Switching Protocols
2
Upgrade: websocket
3
Connection: Upgrade
4
Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=

1
import base64
2
import hashlib
3

4
def compute_accept_key(websocket_key):
5
    # RFC 6455 定义的 GUID
6
    GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
7

8
    # 拼接 Key 和 GUID
9
    combined = websocket_key + GUID
10

11
    # SHA-1 哈希
12
    sha1_hash = hashlib.sha1(combined.encode()).digest()
13

14
    # Base64 编码
15
    accept_key = base64.b64encode(sha1_hash).decode()
16

17
    return accept_key
18

19
# 示例
20
client_key = "dGhlIHNhbXBsZSBub25jZQ=="
21
accept_key = compute_accept_key(client_key)
22
print(accept_key)  # s3pPLMBiTxaQ9kYGzzhZRbK+xOo=

1
def apply_mask(payload, masking_key):
2
    """应用掩码"""
3
    masked = bytearray()
4
    for i, byte in enumerate(payload):
5
        masked.append(byte ^ masking_key[i % 4])
6
    return bytes(masked)
7

8
# 示例
9
masking_key = [0x12, 0x34, 0x56, 0x78]
10
original = b"GET / HTTP/1.1"
11
masked = apply_mask(original, masking_key)
12
print(f"原数据: {original}")
13
print(f"掩码后: {masked}")
14
# 掩码后的数据不再是有效的 HTTP 请求

1
// 客户端心跳实现示例
2
class WebSocketWithHeartbeat {
3
  constructor(url) {
4
    this.ws = new WebSocket(url);
5
    this.heartbeatInterval = null;
6
    this.missedHeartbeats = 0;
7
    this.maxMissedHeartbeats = 3;
8

9
    this.ws.onopen = () => this.startHeartbeat();
10
    this.ws.onclose = () => this.stopHeartbeat();
11
  }
12

13
  startHeartbeat() {
14
    this.heartbeatInterval = setInterval(() => {
15
      if (this.ws.readyState === WebSocket.OPEN) {
16
        this.missedHeartbeats++;
17
        if (this.missedHeartbeats > this.maxMissedHeartbeats) {
18
          // 多次心跳无响应，关闭连接
19
          this.ws.close();
20
          return;
21
        }
22
        // 发送 Ping（浏览器自动响应 Pong）
23
        this.ws.send(JSON.stringify({ type: "ping" }));
24
      }
25
    }, 30000); // 30 秒间隔
26
  }
27

28
  stopHeartbeat() {
29
    if (this.heartbeatInterval) {
30
      clearInterval(this.heartbeatInterval);
31
    }
32
  }
33
}

1
// 恶意网站尝试连接受害者的 WebSocket 服务
2
const ws = new WebSocket("wss://victim-bank.com/ws");
3

4
// 如果服务端不验证 Origin，恶意网站可以建立连接
5
// 并读取受害者的敏感数据（因为浏览器会自动携带 Cookie）

1
// 服务端验证 Origin
2
const WebSocket = require("ws");
3
const wss = new WebSocket.Server({ port: 8080 });
4

5
wss.on("connection", (ws, req) => {
6
  const origin = req.headers.origin;
7
  const allowedOrigins = ["https://example.com", "https://app.example.com"];
8

9
  if (!allowedOrigins.includes(origin)) {
10
    ws.close(1008, "Origin not allowed");
11
    return;
12
  }
13

14
  // 正常处理连接
15
});

1
// 方式一：URL 参数（不推荐）
2
const ws = new WebSocket("wss://example.com/ws?token=xxx");
3

4
// 方式二：子协议（Subprotocol）传递 Token
5
const ws = new WebSocket("wss://example.com/ws", ["bearer", "xxx"]);
6

7
// 方式三：Cookie（推荐，使用 WSS）
8
// 浏览器自动携带 Cookie
9
const ws = new WebSocket("wss://example.com/ws");

1
wss.on("connection", (ws, req) => {
2
  // 从 Cookie 中提取会话
3
  const cookies = req.headers.cookie;
4
  const session = parseCookies(cookies).session;
5

6
  // 验证会话
7
  const user = validateSession(session);
8
  if (!user) {
9
    ws.close(1008, "Unauthorized");
10
    return;
11
  }
12

13
  ws.user = user;
14
});

1
// 定义消息 Schema
2
const messageSchema = {
3
  type: "string", // message, ping, pong, etc.
4
  payload: "object", // 实际数据
5
  timestamp: "number", // 时间戳
6
};
7

8
// 验证消息
9
function validateMessage(data) {
10
  try {
11
    const msg = JSON.parse(data);
12

13
    // 类型检查
14
    if (typeof msg.type !== "string") {
15
      throw new Error("Invalid type");
16
    }
17

18
    // 大小限制
19
    if (data.length > 1024 * 1024) {
20
      // 1MB
21
      throw new Error("Message too large");
22
    }
23

24
    return msg;
25
  } catch (e) {
26
    throw new Error("Invalid message format");
27
  }
28
}
29

30
ws.on("message", data => {
31
  try {
32
    const msg = validateMessage(data);
33
    handleMessage(msg);
34
  } catch (e) {
35
    ws.close(1003, "Invalid data");
36
  }
37
});

1
  0                   1                   2                   3
2
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
3
 +-+-+-+-+-------+-+-------------+-------------------------------+
4
 |F|R|R|R| opcode|M| Payload len |    Close code (2 bytes)      |
5
 |I|S|S|S|  (8)   |A|     (7)     |                               |
6
 |N|V|V|V|       |S|             |    Reason (UTF-8 string)     |
7
 +-+-+-+-+-------+-+-------------+-------------------------------+