WebSocket with Token

[storrisi]

How to connect to a WS with auth token?

[PatrickJS]

I'll have to update the documents and create examples with auth tokens. Here are some resources for you to look into.

https://auth0.com/blog/2014/01/15/auth-with-socket-io/ http://socket.io/docs/migrating-from-0-9/ https://github.com/Automattic/socket.io/wiki/authorizing http://www.christian-schneider.net/CrossSiteWebSocketHijacking.html http://lucumr.pocoo.org/2012/9/24/websockets-101/

[alexcreasy]

I'm also interested in this functionality. From those links are you saying that right now we need to access the socket.io library directly to set the Authorization header of the initial http setup request? I'm guessing the existing $http angular interceptor I have right now won't work?

[SamyuktaPatil]

I am interested in this functionality as well. Any updates or pointers help with this?

[rochapablo]

+1

[tamslinn]

I am interested too. I thought that the initial request was an HTTP upgrade request, so I'd be able to do auth with a header token. However I can't see how to send a header from the client. Is the workaround to send it as a querystring? this doesn't feel quite right.

[BatteryAcid]

+1 It's been a year - any updates to the documentation?

[manuelgchacon]

@gdi2290 +1. Specifically I'm looking to do bearer Authentication with a Token provided by Keycloak. @alexcreasy did you ever get this to work?

[ataraxus]

Any hints how to handle this properly?

[manuelgchacon]

Hey everyone. I hope this helps some people down the road. If the back end WebSocket endpoint is protected by bearer only authentication the following should work. Then access_token query parameter is a standard thing in bearer only authentication

$websocket('https://myhost:8080/mywebsocket' + '?access_token=' + TOKEN);

[ataraxus]

@manuelgchacon i have also settled for this solution, but its not nice:

• Since the token in the url could be easily copied and passed around by a uneducated user.
• Also get token tends to get logged by SSL terminating proxies, web and application servers.
• Another, rather unlikely case would be, that such a token would end up as a referer and be passed to 3rd party servers with its token.

So one has to create one time tokens for accessing the websocket, which definitely increases effort and complexity of backend and client.

Its such a pitty, that there is apparently no common solution from simple HTTP for it, makes me wonder how such a crucial part didn't get much attention while its design.

FYI. I've checked how Slack does handle this and they also use a token in the url :( I guess thats the way to go.

[kullapareddypranay]

I sent the user data from frontend to socket but still searching for accessing it through token