fix: Restrict WebSocket origins to prevent Cross-Site WebSocket Hijacking (CWE-942)

[anushkasrvstv]

Pull Request

PR Description

Summary

This PR fixes a security vulnerability where WebSocket endpoints previously allowed unrestricted or wildcard origins (*), which could lead to Cross-Site WebSocket Hijacking (CWE-942).

It introduces strict origin validation to ensure only explicitly trusted frontend origins can establish WebSocket connections.

Security Fix

➤Removed wildcard "" origin usage from WebSocket configuration
➤Added strict validation for allowed origins in WebSocketConfig
➤Rejects:
▫Empty origins
▫Null values
▫Wildcard "" origins
➤Prevents Cross-Site WebSocket Hijacking (CWE-942)

Changes

➤Introduced app.websocket.allowed-origins configuration property
➤Validated origins using getValidatedOrigins() method
➤Applied secure origins to:
▫/api/ws/notifications (raw WebSocket handler)
▫/api/ws/stomp (STOMP + SockJS endpoints)
➤Updated application.properties with configurable allowlist

Result

➤WebSocket connections are restricted to trusted origins only
➤Eliminates wildcard-based security risk
➤No breaking changes for valid configured environments
➤Backward compatible via environment variables (WEBSOCKET_ALLOWED_ORIGINS)

Issue Reference

Closes #1069

[vercel]

@anushkasrvstv is attempting to deploy a commit to the CodeBlooded's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hi @anushkasrvstv, thanks for contributing to Nyay Setu! 🎉

I have automatically:

• 👤 Assigned this PR to you.
• 🏷️ Applied the gssoc:approved label.

Our workflows will now analyze your changes to classify:

• 📈 PR Difficulty: level:*
• 🧩 PR Type: type:*
• 🌟 PR Quality: quality:*

Tip

Ensure your PR description references the issue it resolves (e.g. Closes #123). This allows the bot to inherit any additional labels from that issue!

Happy coding! 🚀

[anushkasrvstv]

Implemented the fix for WebSocket origin validation.
Waiting for review. Thank you!

[viru0909-dev]

Requires Changes: The test suite failed. Please fix the failing tests.

[anushkasrvstv]

Hi @viru0909-dev ,
Implemented the requested fix and updated test configuration for Java 25 compatibility.
Changes completed:

• Added Surefire plugin configuration with ByteBuddy experimental flag.
• Verified backend tests pass successfully (mvn test).
• Pushed latest changes to this branch
  Please review. If additional changes are needed, I can update accordingly.
  Thank you:)

[viru0909-dev]

Requires Changes. Please address the following issues:

• Title is not following the conventional commits format (e.g. 'feat: ...', 'fix: ...').
  Backend tests failed:\n\n[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 11.75 s <<< FAILURE! -- in com.nyaysetu.backend.NyaySetuBackendApplicationTests [ERROR] com.nyaysetu.backend.NyaySetuBackendApplicationTests.contextLoads -- Time elapsed: 0.005 s <<< ERROR! [ERROR] Tests run: 2, Failures: 0, Errors: 2, Skipped: 0, Time elapsed: 3.498 s <<< FAILURE! -- in com.nyaysetu.backend.controller.RbacSecurityTest [ERROR] com.nyaysetu.backend.controller.RbacSecurityTest.shouldDenyLitigantAccessToAdminEndpoint -- Time elapsed: 0.003 s <<< ERROR! [ERROR] com.nyaysetu.backend.controller.RbacSecurityTest.shouldDenyLitigantAccessToJudgeEndpoint -- Time elapsed: 0.002 s <<< ERROR! [ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.063 s <<< FAILURE! -- in com.nyaysetu.backend.service.SoftDeleteIntegrationTest [ERROR] com.nyaysetu.backend.service.SoftDeleteIntegrationTest.testUserSoftDelete -- Time elapsed: 0.002 s <<< ERROR! [ERROR] Errors: [ERROR] NyaySetuBackendApplicationTests.contextLoads » IllegalState Failed to load ApplicationContext for [WebMergedContextConfiguration@18d3e7fc testClass = com.nyaysetu.backend.NyaySetuBackendApplicationTests, locations = [], classes = [com.nyaysetu.backend.NyaySetuBackendApplication], contextInitializerClasses = [], activeProfiles = ["test"], propertySourceDescriptors = [], propertySourceProperties = ["org.springframework.boot.test.context.SpringBootTestContextBootstrapper=true"], contextCustomizers = [org.springframework.boot.test.context.filter.ExcludeFilterContextCustomizer@45d64d27, org.springframework.boot.test.json.DuplicateJsonObjectContextCustomizerFactory$DuplicateJsonObjectContextCustomizer@4d6ee47, org.springframework.boot.test.mock.mockito.MockitoContextCustomizer@0, org.springframework.boot.test.web.client.TestRestTemplateContextCustomizer@4efc25fc, org.springframework.boot.test.web.reactive.server.WebTestClientContextCustomizer@7fb33394, org.springframework.boot.test.autoconfigure.actuate.observability.ObservabilityContextCustomizerFactory$DisableObservabilityContextCustomizer@1f, org.springframework.boot.test.autoconfigure.properties.PropertyMappingContextCustomizer@0, org.springframework.boot.test.autoconfigure.web.servlet.WebDriverContextCustomizer@56078cea, org.springframework.boot.test.context.SpringBootTestAnnotation@fccc0aa8], resourceBasePath = "src/main/webapp", contextLoader = org.springframework.boot.test.context.SpringBootContextLoader, parent = null] [ERROR] RbacSecurityTest.shouldDenyLitigantAccessToAdminEndpoint » IllegalState Failed to load ApplicationContext for [WebMergedContextConfiguration@2e8fc0c9 testClass = com.nyaysetu.backend.controller.RbacSecurityTest, locations = [], classes = [com.nyaysetu.backend.NyaySetuBackendApplication], contextInitializerClasses = [], activeProfiles = ["test"], propertySourceDescriptors = [], propertySourceProperties = ["org.springframework.boot.test.context.SpringBootTestContextBootstrapper=true"], contextCustomizers = [[ImportsContextCustomizer@1a18b66 key = [org.springframework.boot.test.autoconfigure.web.servlet.MockMvcWebDriverAutoConfiguration, org.springframework.boot.test.autoconfigure.web.servlet.MockMvcAutoConfiguration, org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration, org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration, org.springframework.boot.autoconfigure.security.servlet.SecurityFilterAutoConfiguration, org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration, org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration, org.springframework.boot.test.autoconfigure.web.servlet.MockMvcSecurityConfiguration, org.springframework.boot.test.autoconfigure.web.servlet.MockMvcWebClientAutoConfiguration, org.springframework.boot.test.autoconfigure.web.reactive.WebTestClientAutoConfiguration]], org.springframework.boot.test.context.filter.ExcludeFilterContextCustomizer@45d64d27, org.springframework.boot.test.json.DuplicateJsonObjectContextCustomizerFactory$DuplicateJsonObjectContextCustomizer@4d6ee47, org.springframework.boot.test.mock.mockito.MockitoContextCustomizer@0, org.springframework.boot.test.web.client.TestRestTemplateContextCustomizer@4efc25fc, org.springframework.boot.test.web.reactive.server.WebTestClientContextCustomizer@7fb33394, org.springframework.boot.test.autoconfigure.actuate.observability.ObservabilityContextCustomizerFactory$DisableObservabilityContextCustomizer@1f, org.springframework.boot.test.autoconfigure.properties.PropertyMappingContextCustomizer@4b3fa0b3, org.springframework.boot.test.autoconfigure.web.servlet.WebDriverContextCustomizer@56078cea, org.springframework.boot.test.context.SpringBootTestAnnotation@fccc0aa8], resourceBasePath = "src/main/webapp", contextLoader = org.springframework.boot.test.context.SpringBootContextLoader, parent = null]\n

[anushkasrvstv]

Hi @viru0909-dev ,
All issues addressed:

• Fixed PR title to follow conventional commits format
• Added missing app.websocket.allowed-origins property to test resources — all 12 tests now passing locally.
  Thank you!

[viru0909-dev]

Requires Changes. Please address the following issues:

• Title is not following the conventional commits format (e.g. 'feat: ...', 'fix: ...').
• PR modifies UI components but no screenshot or video is attached in the description.
  Frontend tests failed:\n\n ❯ src/pages/litigant/DocumentGeneratePage.test.jsx (4 tests | 2 failed) 1394ms ⎯⎯⎯⎯⎯⎯⎯ Failed Tests 2 ⎯⎯⎯⎯⎯⎯⎯ FAIL src/pages/litigant/DocumentGeneratePage.test.jsx > DocumentGeneratePage > copies generated content and calls DOCX export actions FAIL src/pages/litigant/DocumentGeneratePage.test.jsx > DocumentGeneratePage > downloads PDF and handles filename and blob flow Test Files 1 failed | 4 passed (5) Tests 2 failed | 14 passed (16)\n

[viru0909-dev]

Review Summary

This PR has been reviewed and requires changes before it can be approved. The issues below must be resolved.

Issues to Resolve

Result	Check	Notes
FAIL	Description	Description is missing: a Checklist section with checkboxes.
FAIL	Checklist	No checklist found in the description.
FAIL	UI Screenshot	This PR modifies UI files but no screenshot or video is attached. Add before/after screenshots or a screen recording showing the change.

Passing Checks

Result	Check	Notes
PASS	Title	Title format is acceptable.
PASS	Issue Link	Issue is linked with a closing keyword.
PASS	Merge Conflicts	Conflict status is not yet computed by GitHub — skipping.
PASS	Branch Freshness	Branch was last updated 2.6 days ago.
PASS	CI / Tests	No CI checks are configured or results are not yet available.
PASS	Code Quality	No code quality issues detected in the diff.

Code Review — Line-by-Line Findings

[INFO] backend/nyaysetu-backend/src/main/resources/application.properties — line 55

app.websocket.allowed-origins=${WEBSOCKET_ALLOWED_ORIGINS:http://localhost:5173,http://localhost:4174,http://localhost:3
Large magic number detected — consider a named constant.

[INFO] backend/nyaysetu-backend/src/test/resources/application.properties — line 20

cors.allowed.origins=http://localhost:5173
Large magic number detected — consider a named constant.

[INFO] backend/nyaysetu-backend/src/test/resources/application.properties — line 21

app.websocket.allowed-origins=http://localhost:3000
Large magic number detected — consider a named constant.

---

To proceed: push the required fixes to fix/websocket-origin-validation-cwe-942 and the PR will be re-evaluated on the next review run.

[anushkasrvstv]

hi @viru0909-dev ,
This is a backend security fix (WebSocket origin validation). No UI components were modified. Not applicable.