[FIXED] Spring Websocket Security: How to prevent SEND request directly to the broker

Issue

Spring Websocket allows clients (I.e. Browsers) to directly send messages to any broker-backed destination, I.e. Allowing direct client-to-client communication bypassing the server-side application. In real world, I don't think it's acceptable to publicly expose write-access directly to your message broker. For security and message-integrity reason, you'll usually want to allow only the server application to ever send any message to the clients via the broker. But I can't find any information on how to achieve this. The default behaviour is browsers have unrestricted read+write direct access to broker destinations.

Solution

This is not technically true, there's no direct communication between the client and the broker, all messages go through your application regardless of the destination type. Broker destination messages are forwarded to the broker, this means you can intercept them at any time before they reach the broker. Spring Security 4.0.0.RC1 has support for WebSocket security so you can apply authorization on your messages:

public class WebSocketSecurityConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer {
    protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
      messages
        .antMatchers(SimpMessageType.MESSAGE, "/topic/**").denyAll()
        .antMatchers("/**").hasRole("ADMIN");
  } 
}

In the above snippet, sending messages to any /topic destination is denied and any other action to other destinations require the role ADMIN. If that's not enough for you, you can always implement your own ChannelInterceptor to intercept messages and add it to the clientInboundChannel.

Answered By - Sergi Almar
Answer Checked By - Mildred Charles (JavaFixing Admin)