InformAction Forums

https://noscript.net/getit/#recent-development-history wrote:v 13.6.15.901
============================================================
[...]
x Block websocket connections where the fetch capability is
disabled (thanks Security Research Labs for report)

Nice to see NoScript can control WebSockets separately now! This is a much more convenient way of default-denying WebSocket connections

Since XHR and Fetch API are basically just script-driven requests, whereas WebSockets are a more persistent connection with more bidirectional communication, I've been thinking of WebSockets as requiring more trust than XHR/fetch(). But NoScript grouping WebSockets under the same "fetch" permission (instead of creating a separate "websocket" permission) suggests that my thinking is incorrect? What am I missing?

This change is a part of an in-depth 3rd party security review NoScript is currently undergoing.

I agree that a separate websocket capability would be more useful, and I'm likely to add it before next stable release.

Additionally, both fetch and websocket, given their nature, will allow the communication to happen only if the permission is granted both to the origin and to destination.