---
title: Avoid cleartext WebSocket connections
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid cleartext WebSocket connections
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid cleartext WebSocket connections

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/insecure-websocket`

**Language:** Dart

**Severity:** Warning

**Category:** Security

**CWE**: [319](https://cwe.mitre.org/data/definitions/319.html)

**Related CWEs**:

- [1428](https://cwe.mitre.org/data/definitions/1428.html)

## Description{% #description %}

A string literal starting with `ws://` opens an unencrypted WebSocket connection, exposing all transmitted messages to network eavesdropping and man-in-the-middle attacks. Replace `ws://` with `wss://` to enforce TLS encryption on the channel. This applies to all WebSocket URLs, including those passed to constructors and third-party package APIs.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
import 'dart:io';

void main() async {
  final socket = await WebSocket.connect('ws://realtime.example.com/feed');
  final channelUrl = "ws://api.example.com/socket";
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
import 'dart:io';

void main() async {
  final secure = await WebSocket.connect('wss://realtime.example.com/feed');
  final channel = "wss://api.example.com/socket";
  final local1 = 'ws://localhost:8080/ws';
  final local2 = 'ws://127.0.0.1/socket';
  final local3 = 'ws://[::1]/ws';
  final logMsg = 'Connecting to ws://realtime.example.com/feed';
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}