I'm setting up a Node.js server to communicate with WebSockets to my web app. I was planning on using JSON Web Tokens to limit access to only users who have already authenticated with our webapp. While researching, I am having trouble finding a WebSocket package for Node.js that supports client-side setting of the Authorization
header and using that on the initial connection call?
I regularly see recommendations to pass the token via query param, which could be less secure than passing the token via the Authorization
header. Am I missing something? Are there any good, well-maintained WebSocket libraries that allow setting the Authorization
header client-side so that I can prevent unwanted connections to the server?
Warning: The server can't send more than one Sec-Websocket-Protocol header. If the server doesn't want to use any subprotocol, it shouldn't send any Sec-WebSocket-Protocol header. Sending a blank header is incorrect. The client may close the connection if it doesn't get the subprotocol it wants.
Authentication FlowThe client makes a WebSocket handshake request with the external authentication token passed as a query-string parameter in the handshake endpoint URL. The server checks the cache to see if the external authentication token is valid.
Browser-based WebSocket API does not make it possible to specify HTTP headers. On the other hand, the query param approach works and is not that bad (when used over HTTPS), so it's often used instead.
Although there are WebSocket implementations for Node.js that make it possible to specify HTTP headers, this only works when running the client in Node.js. It doesn't work when running in a browser.
Einaros' ws
is one such example. Passing a JWT token via Authorization
header is simple when running in Node.js:
var WebSocket = require("ws");
' does not work in browsers
var token = "Replace_this_with_your_JWT_token";
var options = {
headers: {
"Authorization" : "JWT " + token
}
};
var ws = new WebSocket("wss://example.com/path", options);
...
But when used from Browserify, requiring ws
simply returns the ordinary browser-based WebSocket API that is unable of passing custom headers. And unless web browsers add support for passing headers, passing via the query param is the way to go.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With