The most popular and comprehensive Open Source ECM platform
Let us know more
HTML Over WebSockets: Responsiveness with Low Latency, but Be Careful
Single-page Apps (SPA) have ruled developer mindsets over the last decade. The problem is that current SPA architectures are flawed. On the front end, the developer writes Javascript-based applications that exchange JSON packages asynchronously to backend RESTful APIs. In this world, RESTful APIs rule. A problem is that the front end and the back end are typically written in two different languages and must be maintained separately and use JSON as the intermediary communication.
An alternative to this approach is beginning to be explored by some development teams: HTML over WebSocket. In that approach, when a web app is initiated, the front end opens a WebSocket connection to the backend. The front end requests content via URIs to the backend which responds by sending back HTML fragments that the front-end inserts into the page DOM.
It turns out that this approach significantly reduces the use of Javascript because the HTML data fragment is constructed on the backend. WebSockets is also a speedier protocol compared to HTTP. For applications like chatbots, pushing communication back and forth via an open socket is particularly speedy. WebSocket apps have the potential to be responsive with low latency. So, while the idea of the WebSocket approach has advantages and is gaining some traction, won’t the approach have its own set of weaknesses? Everything always does.
Generally the WebSocket approach is a win, but there are some potentially serious problems. One is that processing is pushed back to the server, requiring more resources on the server, but a big issue is that the architecture makes it necessary to have a WebSocket open for every client.
Jason Gillam, analyzed one app built as an SPA WebSocket app and found numerous security issues with the implementation, attributed to the fact that WebSocket apps aren’t as well understood as the dominant HTTP implementations. While one app can’t represent all apps, it does make one pause. Gillam wrote that “We therefore believe organizations should be extra cautious of WebSockets and understand that they are often misunderstood and not implemented with proper security controls in place.”
