1

We have a Google http(S) LB in front of a Google Compute VM, and we are routing a subdomain to the backend which exposes only a wss endpoint. I couldn't find any example for javascript code how to use Authentication with Google IAP and OIDC Tokens.

Does Google IAP support query parameters for the authentication ? I found this entry:
Bearer authentication for websocket

Thanks for any advice

FreshMike
  • 481
  • 1
  • 6
  • 26

1 Answers1

0

There is no method in the JavaScript WebSockets API to customize WebSocket headers from JavaScript, you’re limited to the “implicit” auth (i.e. Basic or cookies) that are sent from the browser. Further, it’s common to have the server that handles WebSockets be completely separate from the one handling “normal” HTTP requests. This can make shared authorization headers difficult or impossible. One way to attain this is using a “ticket”-based authentication system.

  • When the client-side code decides to open a WebSocket, it contacts the HTTP server to obtain an authorization “ticket”.

  • The server generates the ticket. It typically contains some sort of user/account ID, the IP of the client requesting the ticket, a timestamp, and any other sort of internal record keeping you might need.

  • The server stores this ticket (i.e. in a database or cache), and returns it to the client.

  • The client opens the WebSocket connection, and sends along this “ticket” as part of an initial handshake.

  • The server can then compare this ticket, check source IPs, verify that the ticket hasn’t been re-used and hasn’t expired, and do any other sort of permission checking. If all goes well, the WebSocket connection is now verified.

Refer to the link for websocket security and related stack posts HTTP headers in websockets client API and Websocket authentication.

Srividya
  • 1,678
  • 3
  • 10