For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/dart-security/insecure-websocket.md. A documentation index is available at /llms.txt.

Avoid cleartext WebSocket connections

This product is not supported for your selected Datadog site. ().

Metadata

ID: dart-security/insecure-websocket

Language: Dart

Severity: Warning

Category: Security

CWE: 319

Related CWEs:

Description

A string literal starting with ws:// opens an unencrypted WebSocket connection, exposing all transmitted messages to network eavesdropping and man-in-the-middle attacks. Replace ws:// with wss:// to enforce TLS encryption on the channel. This applies to all WebSocket URLs, including those passed to constructors and third-party package APIs.

Non-Compliant Code Examples

import 'dart:io';

void main() async {
  final socket = await WebSocket.connect('ws://realtime.example.com/feed');
  final channelUrl = "ws://api.example.com/socket";
}

Compliant Code Examples

import 'dart:io';

void main() async {
  final secure = await WebSocket.connect('wss://realtime.example.com/feed');
  final channel = "wss://api.example.com/socket";
  final local1 = 'ws://localhost:8080/ws';
  final local2 = 'ws://127.0.0.1/socket';
  final local3 = 'ws://[::1]/ws';
  final logMsg = 'Connecting to ws://realtime.example.com/feed';
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Security

Datadog Code Security