4

IIUC, when I create a WebSocket an HTTP request is sent to the specified URL, containing an upgrade request. Is it typicaly to pass authentication information along with this upgrade request, or should it be performed separately?

var websocket = new WebSocket("ws://domain:port/foo"); // Can I include authentication headers with the initial upgrade HTTP request?
Ben Aston
  • 53,718
  • 65
  • 205
  • 331
  • there is no authentication... – dandavis Mar 10 '15 at 13:41
  • @dandavis Please can you clarify. Surely authentication headers can be sent along with the upgrade request - it being an HTTP request. – Ben Aston Mar 10 '15 at 13:51
  • i meant shown... an http url is an http url. that said, it's typically somewhat incumbent on the socket package to catch incoming connections, so integration options might be limited by the socket host, but not http. you could do something fancy with a redirect to the socket-provided http url at the end. – dandavis Mar 10 '15 at 14:05
  • I see, so the WebSocket API provides no direct way to configure the HTTP headers sent with the connection request? – Ben Aston Mar 10 '15 at 14:24
  • you would need to dig into the docs for whatever server-side websockets tool you're using, but don't get your hopes up. that said, it's really easy to make the client send a token through the socket itself, and not give them any data until they do, and dropping them if they take to long or make bad guesses. – dandavis Mar 10 '15 at 14:29

2 Answers2

6

The WebSocket RFC standard doesn't define any protocol-specific client authentication mechanism but mentions that HTTP authentication is a possible option:

10.5. WebSocket Client Authentication

This protocol doesn't prescribe any particular way that servers can authenticate clients during the WebSocket handshake. The WebSocket
server can use any client authentication mechanism available to a
generic HTTP server, such as cookies, HTTP authentication, or TLS
authentication.

The standard for http URLs prescribes a form which includes the login credentials within the URL. The form is http://username:password@www.example.com/file. But this syntax is not supported by all browsers because, frankly, it was a really bad idea.

The WebSocket API does not expose any features intended for HTTP client authentication. That means web browsers are supposed to provide authentication the way they usually do: With the URL syntax above when they decide to support it or by showing a popup to the user where they enter their login credentials.

Community
  • 1
  • 1
Philipp
  • 67,764
  • 9
  • 118
  • 153
3

You should do the authentication through web, return a cookie and then connect to the websocket server again, carrying the cookie. The WS server can validate the cookie

If there is no cookie based authentication or it is just not possible (like the WS server in another domain), you will have to create your own request-response messages for login.

vtortola
  • 34,709
  • 29
  • 161
  • 263