title: Securing Websockets
body: <p>Right now our application is designed to facilitate all communication via websockets after the initial load.</p>
  
  <p>We are trying to figure out a solution to safely pass sensitive data via this transport.</p>
  
  <p>So far we are thinking about a few things:</p>
  
  <ol>
  <li>Authentication of the websocket transport by passing back a unique
  hash stored in a session cookie delivered via SSL on initial load.</li>
  <li><p>Client-side encryption using something like a javascript bcrypt
  implementation to encrypt everything before it is transported.</p></li>
  <li><p>Just passing all sensitive data with a normal post via SSL even
  though we dont want to.</p></li>
  </ol>
  
  <p>Something like number 1 would be the best outcome but we are unaware if websokets are vulnerable to things like man in the middle attacks even after authentication.</p>
  
  <p>Any help sussing out possible security downfalls, or any other ideas on how to achieve true security over websockets would be greatly appreciated!</p>