RFC 6455 Quiz

Q1: A WebSocket connection typically starts as

Multiple Choice

A. A DNS TXT record exchange B. A UDP broadcast C. An HTTP request that asks to upgrade the connection

**Explanation:** **Correct (C):** WebSocket uses an HTTP handshake with Upgrade and Connection headers

Q2: Which pair of schemes matches WebSocket and WebSocket over TLS

Multiple Choice

A. ws and wss B. http and https C. tcp and tls

**Explanation:** **Correct (A):** ws is plaintext, wss runs over TLS

Q3: A server wants to prevent a browser from using a victim's cookies to open a privileged WebSocket. Which check is relevant

Multiple Choice

A. Ignore the Origin header entirely B. Validate the Origin header against allowed origins C. Require the client to send Accept-Language

**Explanation:** **Correct (B):** Browsers send Origin on the handshake. Servers commonly use it as a CSRF like defense

Q4: Which header is used by the client to carry a random value that the server uses to compute Sec-WebSocket-Accept

Multiple Choice

A. Sec-WebSocket-Key B. Sec-WebSocket-Accept C. Sec-WebSocket-Token

**Explanation:** **Correct (A):** Client sends Sec-WebSocket-Key, server replies with Sec-WebSocket-Accept

Q5: Which statements about WebSocket are correct (select all)

Multi-Select

A. After the handshake, messages are framed in the WebSocket format B. Using wss helps prevent passive observation and tampering C. The handshake is initiated with an HTTP request D. The protocol guarantees that the application is authenticated

**Explanation:** **Correct (A,B,C):** WebSocket defines framing and uses HTTP for the initial upgrade **Options:** - D (incorrect): Authentication depends on your app and deployment

Q6: Name the request header commonly used to enforce allowed browser origins (one word)

Short Text

**Explanation:** **Correct:** Origin

The WebSocket Protocol

References (URLs)

Q1: A WebSocket connection typically starts as

Q2: Which pair of schemes matches WebSocket and WebSocket over TLS

Q3: A server wants to prevent a browser from using a victim's cookies to open a privileged WebSocket. Which check is relevant

Q4: Which header is used by the client to carry a random value that the server uses to compute Sec-WebSocket-Accept

Q5: Which statements about WebSocket are correct (select all)

Q6: Name the request header commonly used to enforce allowed browser origins (one word)