How to secure Websocket Server in Java EE 7

Question

I'd like to create a simple CRUD application using web sockets, with a Java EE 7 Websocket Server, running on Glassfish 4, communicating with a single page website. My question is: how can I secure my application? In other words: how can I perform user Authentication and Authorization? Because there are a few messages that I would like the Server to reply to only after authentication and authorization of the requesting user. Last but not least: how can I provide a "remember me" function? Thank you.

Answer 1

A practical method is for the user to login via your Web page, setting a cookie from your Web app upon successful authentication, and check that cookie in your WebSocket server on the incoming WebSocket connection from the page.

This will require to have the Web page and the WebSocket served from the same origin (otherwise the browser won't send the cookie on the WebSocket connection).

Another possibility is to implement a custom authentication mechanism via messages on top of the WebSocket connection.

Another possibility is to use TLS and client-certificate based authentication.

Note that though WebSocket has a HTTP based initial opening handshake and you can in principle use any HTTP authentication mechanism, there are practical restrictions. E.g. with HTTP basic authentication, browsers will render login dialogs for plain HTML page requests, but not for so-called subresources, like requests for images .. and WebSocket (which also counts as a subresources).