topic Re: web sockets in Browse

web sockets

LazarusG — Fri, 05 Sep 2025 10:20:05 GMT

What support can Checkpoint offer for web sockets.

I must admit I have not encountered them before in my networking career.

Our customer has a proxy product that cannot granularly filter them and sends everything uninspected.

They have on-prem gateways.

If they bypass their proxy can we leverage https inspection/apcl/url filtering logic in the on-prem gateways to apply security policy to ws:// and wss:// sites?

Will the cloud WAF product be able to do this?

Thanks

Re: web sockets

Danny — Fri, 05 Sep 2025 14:57:34 GMT

WebSockets are everywhere. Many WebUI's heavily make us of them. Interactive online games, like LittleWarGame, wouldn't work without wss. I've created several tools to tinker with those nifty sockets. They are the hidden engine of many online communications these days.

Re: web sockets

PhoneBoy — Fri, 05 Sep 2025 16:40:13 GMT

We support WebSocket in the context of Mobile Access Blade: https://support.checkpoint.com/results/sk/sk95311
It appears CloudGuard WAF supports this also, but that's more for protecting the server side of this.

Re: web sockets

LazarusG — Tue, 09 Sep 2025 08:41:14 GMT

Thanks - the official comment from the proxy vendor was that web sockets require a forward and reverse proxy function due to the protocol having the ability to switch/upgrade mid stream: they couldn't do it as the appliance was a forward proxy only. I know there is an application definition in Checkpoint, but it would be more about how to exempt the web socket traffic from the main web traffic on the proxy to send it somewhere else I guess. WAF is interesting. Anyway the issue has left my support queue so it someone else problem now 🙂

Re: web sockets

PhoneBoy — Tue, 09 Sep 2025 15:15:00 GMT

We do have reverse proxy functionality also, FYI: https://support.checkpoint.com/results/sk/sk110348