TsgcWebSocketHTTPServer › Properties › SecurityOptions
Defines handshake admission rules: allowed origins, RFC 6455 handshake validation, and HSTS response headers.
property SecurityOptions: TsgcWSSecurity_Options read FSecurityOptions write SetSecurityOptions;| Name | Default | Description |
|---|---|---|
OriginsAllowed | "" | Comma-separated whitelist of origins accepted for browser WebSocket handshakes. Empty allows all origins. |
EnforceWebSocketVersion | True | Rejects an RFC 6455 handshake whose Sec-WebSocket-Version is not 13. |
ValidateWebSocketKey | True | Rejects an RFC 6455 handshake whose Sec-WebSocket-Key is not a valid 16-byte base64 nonce. |
HSTS_Options.Enabled | False | Enables the Strict-Transport-Security response header. See Remarks. |
HSTS_Options.MaxAge | 31536000 | Value in seconds for the header's max-age directive (default is one year). SSL Labs requires at least 15552000 (six months) for an A+ rating. |
HSTS_Options.IncludeSubDomains | False | Adds includeSubDomains to the header. Enable only if every subdomain is served over HTTPS. |
HSTS_Options.Preload | False | Adds preload to the header. Enable only for domains submitted to the browsers' HSTS preload list. |
Use OriginsAllowed to lock down which origins the server accepts WebSocket handshakes from. By default all origins are allowed; any non-empty value enables a whitelist and the server closes connections whose Origin header does not match. Patterns accept wildcards for the port (for example http://127.0.0.1:5555 for a single origin or http://127.0.0.1:* to accept any port on that host). Separate multiple origins with commas. Setting OriginsAllowed to an empty string restores the permissive default.
EnforceWebSocketVersion and ValidateWebSocketKey harden the WebSocket upgrade itself and are enabled by default. When EnforceWebSocketVersion is active the server answers a handshake that requests a version other than 13 with HTTP 426 Upgrade Required and a Sec-WebSocket-Version: 13 header, instead of completing the upgrade. When ValidateWebSocketKey is active the server rejects with HTTP 400 Bad Request any handshake whose Sec-WebSocket-Key is missing or is not a 24-character base64 value that decodes to 16 bytes, as required by RFC 6455. Both checks apply only to the RFC 6455 path, so legacy Hixie76 clients are unaffected. Set either to False only if you must interoperate with a non-conformant client.
The same options are available on TsgcWebSocketServer and the http.sys server TsgcWebSocketServer_HTTPAPI. To bound the size of inbound messages see MaxMessageSize.
HSTS_Options controls the Strict-Transport-Security response header defined by RFC 6797. When Enabled is True, every HTTP/1.1 and HTTP/2 response sent over TLS includes a Strict-Transport-Security header built from MaxAge, IncludeSubDomains and Preload, for example Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. The header is never sent over plain HTTP, is skipped if the application already set a Strict-Transport-Security header on the response, and is not added to responses whose headers the application writes itself (streaming). HSTS_Options is available on this component and on TsgcHTTPServer only; it has no effect on TsgcWebSocketServer or the http.sys server TsgcWebSocketServer_HTTPAPI.
oServer := TsgcWebSocketHTTPServer.Create(nil);
oServer.SecurityOptions.OriginsAllowed := 'http://127.0.0.1:*';
oServer.SecurityOptions.EnforceWebSocketVersion := true;
oServer.SecurityOptions.ValidateWebSocketKey := true;
oServer.SecurityOptions.HSTS_Options.Enabled := true;
oServer.SecurityOptions.HSTS_Options.MaxAge := 31536000;
oServer.Active := true;