MQTTnet.Extensions.WebSocket4Net uses several outdated and possibly vulnerable dependencies

[DerGary]

MQTTnet.Extensions.WebSocket4Net uses several outdated and possibly vulnerable dependencies

[chkr1011]

It seems that WebSocket4Net is no longer maintained. The latest release is from 2018. So, I am afraid there is not much we can do about it. The only reason for having this extension is that the web socket implementation in the .NET Framework does not support several encryption algorithms.

For me the only option is to get rid of that extension completely. Or do you have another suggestion?

[DerGary]

I don't know what the Library WebSocket4Net does, I just found out about the vulnerability through our toolset. I don't really have a suggestion apart from using a different library or creating necessary code to implement the missing features.

Is there an alternative way to use mqtt via websocket?

[chkr1011]

There is no need for the extension at all. The .NET Framework has proper support for WebSockets. The API from MQTTnet is the same. You basically can remove the WebSocket4Net extension from the project. The only reason why it was created in the past is that it has support for some encryption algorithms wich the .NET Version does not.

[chkr1011]

Starting with version 5.0.0.0 of this library the library WebSocket4Net will no longer be used because the extension library is no longer provided.