SAPUI5 WebSocket authentication

Question

I have created a service in SAP backend that serves for websocket connections. I wanna connect to that service from SAPUI5 application. I connect to the service like this:

sap.ui.require("sap/ui/core/ws/WebSocket");
        var socket = new WebSocket(
                'ws://<host>:<port>/sap/bc/apc/sap/z_reg_test_push_ch');

When this piece of code is called I get:

WebSocket connection to 'ws://<host>:<port>/sap/bc/apc/sap/z_reg_test_push_ch' failed: HTTP Authentication failed; no valid credentials available

When I test the service from backend it will open the service url in chrome and asks me for credentials. Then when I refresh the UI5 app the webservice connection is established because the user has already logged in the same session in chrome when testing the service from backend.

In SAPUI5 app I can access the security token which was returned when connecting to oData service. I can access is like this:

var oModel = sap.ui.getCore().getModel();
oModel.getSecurityToken();

the token looks like this: cKYPxpo7-BELSah1D1WRgg==

I have found a thread that I should create the websocket connection like this:

new WebSocket('ws://<host>:<port>/sap/bc/apc/sap/z_reg_test_push_ch',["access_token", oModel.getSecurityToken()]);

But I get this message:

Uncaught DOMException: Failed to construct 'WebSocket': The subprotocol 'cKYPxpo7-BELSah1D1WRgg==' is invalid.

To sum it up. I am authenticated by the oData service via basic auth and I want to pass to the socket the authentication info.

I don't think it works that way, `getSecurityToken` returns the csrf token, not the bearer token — Jorg, Oct 13 '18 at 12:20
I honestly don’t know. The actual values are in one of the cookies — Jorg, Oct 15 '18 at 06:36
I just remembered there’s a thing called ABAP Channels. I think it’s just a socket implementation / wrapper. There are some blogs on using it with UI5. — Jorg, Oct 18 '18 at 07:20
Yeah, I went trough all the tutorials and documentation and no one really explained how to authenticate the WebSocket. For them it somehow just worked. — miskohut, Oct 18 '18 at 07:56

score 1 · Accepted Answer · answered Oct 17 '18 at 10:47

I have found that to pass user credentials to the ICF service, you have to create the websocket like this:

new WebSocket('ws://<username>:<password>@<host>:<port>/<path_to_service>')

This, however, raises a security problem, since the connection is not secured, so every one can read the user credentials.

But I did not find any other solution of the authenticate a user.

SAPUI5 WebSocket authentication

1 Answers1