https://souljian.cn/tags/%E5%AE%9E%E6%97%B6%E9%80%9A%E4%BF%A1/Recent content in 实时通信 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088239/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088239/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>WebSocket 测试只在授权环境进行。</p> <h2 id="一websocket-协议">一、WebSocket 协议 </h2><img src="https://souljian.cn/img/osi-tcp-model.svg" alt="WebSocket 协议" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① HTTP 握手 → ② 升级 WebSocket → ③ 双向通信 → ④ 数据帧传输 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二安全测试">二、安全测试 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">认证绕过：直接 ws:// 连接 </span></span><span class="line"><span class="cl">XSS：通过 WebSocket 窃取数据 </span></span><span class="line"><span class="cl">输入验证：WebSocket 消息注入 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">WSS（WebSocket Secure）· 认证 · 输入验证 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>WebSocket 是实时通信的核心协议。安全测试重点是<strong>认证 + 输入验证</strong>。</p>