websocket - Difference between ws and wss?

Question

What is the procedure to change ws into wss?

Whether wss is make upgrade over normal HTTP or wss works only HTTPS?

webSocket = new WebSocket("ws://localhost:port/Esv/ocp");

works fine, when I changed ws to wss

webSocket = new WebSocket("wss://localhost:port/Esv/ocp");

it shows this error:

Error in connection establishment: net::ERR_SSL_PROTOCOL_ERROR

Answer 1

Short version

To SSL or not SSL

You may have a SSL certificate issue. The connection point rule can be summarized as:

• wss connects on https only
• ws connects on http

and vice-versa:

• https accepts wss only
• http accepts ws only

Errors

Following situations will lead you to an error (tests done under Firefox):

• If you want to connect a wss connection to a http endpoint. In my tests, I had an

  InvalidStateError: An attempt was made to use an object that is not, or is no longer, usable

• If you want to connect a ws connection to a https endpoint, you'll have the error

  SecurityError: The operation is insecure.

Formal answer

The bible of websocket is RFC 6455. In section 4.1.5:

If /secure/ is true, the client MUST perform a TLS handshake over the connection after opening the connection and before sending the handshake data [RFC2818]. If this fails (e.g., the server's certificate could not be verified), then the client MUST Fail the WebSocket Connection and abort the connection. Otherwise, all further communication on this channel MUST run through the encrypted tunnel [RFC5246].

The secure flag is defined by the URI. Section 3 defines what is secure

The URI is called "secure" (and it is said that "the secure flag is set") if the scheme component matches "wss" case-insensitively.

---

TL;DR

If you want to use wss:

• you must have SSL activated
• your endpoint point must be secured (https://...): "security downgrade" is not allowed

If you want to use ws:

• Make sure your endpoint does not have SSL enabled (http://...)