# Security

This covers basic security for protocols you’re serving via Channels and helpers that we provide.

## WebSockets

WebSockets start out life as a HTTP request, including all the cookies and headers, and so you can use the standard Authentication code in order to grab current sessions and check user IDs.

There is also a risk of cross-site request forgery (CSRF) with WebSockets though, as they can be initiated from any site on the internet to your domain, and will still have the user’s cookies and session from your site. If you serve private data down the socket, you should restrict the sites which are allowed to open sockets to you.

This is done via the `channels.security.websocket` package, and the two ASGI middlewares it contains, `OriginValidator` and `AllowedHostsOriginValidator`.

`OriginValidator` lets you restrict the valid options for the `Origin` header that is sent with every WebSocket to say where it comes from. Just wrap it around your WebSocket application code like this, and pass it a list of valid domains as the second argument. You can pass only a single domain (for example, `.allowed-domain.com`) or a full origin, in the format `scheme://domain[:port]` (for example, `http://allowed-domain.com:80`). Port is optional, but recommended:

    from channels.security.websocket import OriginValidator

    application = ProtocolTypeRouter({

        "websocket": OriginValidator(
            AuthMiddlewareStack(
                URLRouter([
                    ...
                ])
            ),
            [".goodsite.com", "http://.goodsite.com:80", "http://other.site.com"],
        ),
    })

Note: If you want to resolve any domain, then use the origin `*`.

Often, the set of domains you want to restrict to is the same as the Django `ALLOWED_HOSTS` setting, which performs a similar security check for the `Host` header, and so `AllowedHostsOriginValidator` lets you use this setting without having to re-declare the list:

    from channels.security.websocket import AllowedHostsOriginValidator

    application = ProtocolTypeRouter({

        "websocket": AllowedHostsOriginValidator(
            AuthMiddlewareStack(
                URLRouter([
                    ...
                ])
            ),
        ),
    })

`AllowedHostsOriginValidator` will also automatically allow local connections through if the site is in `DEBUG` mode, much like Django’s host validation.