javascript - Configuring authentication headers for WebSocket connection - Stack Overflow

admin管理员组

文章数量:1287511

IIUC, when I create a WebSocket an HTTP request is sent to the specified URL, containing an upgrade request. Is it typicaly to pass authentication information along with this upgrade request, or should it be performed separately?

var websocket = new WebSocket("ws://domain:port/foo"); // Can I include authentication headers with the initial upgrade HTTP request?

IIUC, when I create a WebSocket an HTTP request is sent to the specified URL, containing an upgrade request. Is it typicaly to pass authentication information along with this upgrade request, or should it be performed separately?

var websocket = new WebSocket("ws://domain:port/foo"); // Can I include authentication headers with the initial upgrade HTTP request?

• javascript
• http
• websocket

Share Improve this question Follow edited Mar 10, 2015 at 14:00 Ben Aston asked Mar 10, 2015 at 13:35 Ben AstonBen Aston 55.8k6969 gold badges220220 silver badges349349 bronze badges 5

• there is no authentication... – dandavis Commented Mar 10, 2015 at 13:41
• @dandavis Please can you clarify. Surely authentication headers can be sent along with the upgrade request - it being an HTTP request. – Ben Aston Commented Mar 10, 2015 at 13:51
• i meant shown... an http url is an http url. that said, it's typically somewhat incumbent on the socket package to catch ining connections, so integration options might be limited by the socket host, but not http. you could do something fancy with a redirect to the socket-provided http url at the end. – dandavis Commented Mar 10, 2015 at 14:05
• I see, so the WebSocket API provides no direct way to configure the HTTP headers sent with the connection request? – Ben Aston Commented Mar 10, 2015 at 14:24
• you would need to dig into the docs for whatever server-side websockets tool you're using, but don't get your hopes up. that said, it's really easy to make the client send a token through the socket itself, and not give them any data until they do, and dropping them if they take to long or make bad guesses. – dandavis Commented Mar 10, 2015 at 14:29

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 6

The WebSocket RFC standard doesn't define any protocol-specific client authentication mechanism but mentions that HTTP authentication is a possible option:

10.5. WebSocket Client Authentication

This protocol doesn't prescribe any particular way that servers can authenticate clients during the WebSocket handshake. The WebSocket
server can use any client authentication mechanism available to a
generic HTTP server, such as cookies, HTTP authentication, or TLS
authentication.

The standard for http URLs prescribes a form which includes the login credentials within the URL. The form is http://username:[email protected]/file. But this syntax is not supported by all browsers because, frankly, it was a really bad idea.

The WebSocket API does not expose any features intended for HTTP client authentication. That means web browsers are supposed to provide authentication the way they usually do: With the URL syntax above when they decide to support it or by showing a popup to the user where they enter their login credentials.

You should do the authentication through web, return a cookie and then connect to the websocket server again, carrying the cookie. The WS server can validate the cookie

If there is no cookie based authentication or it is just not possible (like the WS server in another domain), you will have to create your own request-response messages for login.

本文标签： javascriptConfiguring authentication headers for WebSocket connectionStack Overflow