[rad_gruchalski]

But this example works and, I assume, is intended to work over localhost. How would cross origin detection work in this case?

[mic159]

The websocket server needs to check the "Origin" header from the client. The code then needs to know what is expected (eg localhost or 127.0.0.q). If the origin header is something like "evil.xyz.com", then it needs to reject the connection.

[rad_gruchalski]

Yes, I understand how origin verification is done. Nothing stops any other local app to make make a WS connection to this app's server and pretend it is making valid requests while, potentially, executing destructive actions or stealing data.

I understand that the generic answer will be along the lines: "well, if you have local access, you're never safe", but there is zero protection here. Anything local can connect to it and impersonate the "front end".

[kingosticks]

An example is at https://www.tornadoweb.org/en/stable/websocket.html#tornado....