Go WebSocket upgrader CheckOrigin accepts any origin
Rule ID: vetkit.go.websocket.permissive-origin-check
The WebSocket upgrader accepts connections from any origin, so a page on any website can open an authenticated socket with the visitor's cookies (cross-site WebSocket hijacking).
Last updated:
Suite: Security
go
The WebSocket upgrader accepts connections from any origin, so a page on any website can open an authenticated socket with the visitor's cookies (cross-site WebSocket hijacking).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Compare the Origin header against the site's own origins (leave CheckOrigin unset for same-origin only, or list the allowed hosts in OriginPatterns / Origins).
References
Source: packages/engine/rules/sast/go.yml.
Related checks
- Go command injection: request input picks the program
- Go command injection via sh -c or bash -c exec.Command
- Go cookie with HttpOnly set to false readable by scripts
- Go cookie with Secure flag disabled sent over plain HTTP
- Go CORS allows all origins with credentials enabled
- Go block cipher in ECB mode leaks plaintext structure
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.