Configuring authentication headers for WebSocket connection

Question

IIUC, when I create a WebSocket an HTTP request is sent to the specified URL, containing an upgrade request. Is it typicaly to pass authentication information along with this upgrade request, or should it be performed separately?

var websocket = new WebSocket("ws://domain:port/foo"); // Can I include authentication headers with the initial upgrade HTTP request?

@dandavis Please can you clarify. Surely authentication headers can be sent along with the upgrade request - it being an HTTP request. — Ben Aston
– Ben Aston, Commented Mar 10, 2015 at 13:51
i meant shown... an http url is an http url. that said, it's typically somewhat incumbent on the socket package to catch incoming connections, so integration options might be limited by the socket host, but not http. you could do something fancy with a redirect to the socket-provided http url at the end. — dandavis
– dandavis, Commented Mar 10, 2015 at 14:05
I see, so the WebSocket API provides no direct way to configure the HTTP headers sent with the connection request? — Ben Aston
– Ben Aston, Commented Mar 10, 2015 at 14:24
you would need to dig into the docs for whatever server-side websockets tool you're using, but don't get your hopes up. that said, it's really easy to make the client send a token through the socket itself, and not give them any data until they do, and dropping them if they take to long or make bad guesses. — dandavis
– dandavis, Commented Mar 10, 2015 at 14:29

Community · Accepted Answer · 2021-10-07 08:46:00Z

The WebSocket RFC standard doesn't define any protocol-specific client authentication mechanism but mentions that HTTP authentication is a possible option:

10.5. WebSocket Client Authentication

This protocol doesn't prescribe any particular way that servers can authenticate clients during the WebSocket handshake. The WebSocket
server can use any client authentication mechanism available to a
generic HTTP server, such as cookies, HTTP authentication, or TLS
authentication.

The standard for http URLs prescribes a form which includes the login credentials within the URL. The form is http://username:[email protected]/file. But this syntax is not supported by all browsers because, frankly, it was a really bad idea.

The WebSocket API does not expose any features intended for HTTP client authentication. That means web browsers are supposed to provide authentication the way they usually do: With the URL syntax above when they decide to support it or by showing a popup to the user where they enter their login credentials.

vtortola · Accepted Answer · 2015-03-11 10:20:53Z

3

You should do the authentication through web, return a cookie and then connect to the websocket server again, carrying the cookie. The WS server can validate the cookie

If there is no cookie based authentication or it is just not possible (like the WS server in another domain), you will have to create your own request-response messages for login.

answered Mar 11, 2015 at 10:20

vtortola

36.1k33 gold badges169 silver badges270 bronze badges

2 Comments

Tvaroh Over a year ago

Why not pass session ID in WS URL param?

nhooyr Over a year ago

URL params are usually logged by proxies.

Collectives™ on Stack Overflow

Configuring authentication headers for WebSocket connection

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related