HTTP上的WSS与HTTPS上的WSS [英] WSS on HTTP vs WSS on HTTPS

问题描述

我已经读过WSS只适用于HTTP，并且WSS适用于HTTP和HTTPS。 WSS（安全Web套接字）连接在HTTP服务器上是否与在HTTPS服务器上一样安全？如果网站/服务器不是通过TLS / SSL加密的Web套接字安全（WSS）连接吗？

I've read that WSS only works on HTTP, and that WSS works on both HTTP and HTTPS. Are WSS (Secure Web Socket) connections just as secure on an HTTP server as they are on an HTTPS server? Is a Web Socket Secure (WSS) connection still encrypted through TLS/SSL if the website/server is not?

推荐答案

如果网站/服务器不是通过TLS / SSL加密的网络套接字安全（wss）连接？

Is a web socket secure (wss) connection still encrypted through TLS/SSL if the website/server is not?

是。

wss（安全Web套接字）连接在http服务器上是否与在https服务器上一样安全？

Are wss (Secure Web Socket) connections just as secure on an http server as they are on an https server?

是（见上文）。有一点需要注意：如果打开安全WebSocket连接的HTML / JavaScript通过非安全HTTP传递，则WebSocket连接仍然是安全的，但攻击者可能会在从Web服务器发送到浏览器时修改HTML / JavaScript 。 HTTP连接不受中间人嗅探或修改的保护。

Yes (see above). There is one thing to note: if the HTML/JavaScript that opens the secure WebSocket connection comes over non-secure HTTP, the WebSocket connection is still secure, but an attacker might modify the HTML/JavaScript while being sent from the Web server to browser. A HTTP connection isn't protected against man-in-the-middle sniffing or modification.

这篇关于HTTP上的WSS与HTTPS上的WSS的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！