Take the 2-minute tour ×  On the doc Specifying WebSocket
authentication details, it did not mention how are passwords
being sent from client's authenticate() JS func to server's
onWSAuthenticate. Are they being sent through a secure channel?
or in plain text?  Side question: what tool / browser /
browser's plugin can one use to sniff through websocket's
traffic?  Thank you.  share|improve this question can't answer
the authentication question, but Fiddler should allow you to
sniff the websocket's traffic. –  Matt Busche May 16 '12 at 2:53
add comment  2 Answers  up vote 1 down vote accepted
username/password sent through authenticate() function is in
clear-text. You can actually see that in cfwebsocket.js (its
minified so search for authenticate). On server if the call is
for authentication, it would invoke onWSAuthenticate() in
application.cfc passing whatever username or password given to
the function. So the logic of encryption/decryption/validation
lies with the developer.  Any TCP monitor can be used f