Authentication and Authorization

Securing WebSocket Interactions

Auth Challenges for WebSockets

Authentication During Handshake

Passing Credentials: Query Params

Passing Credentials: HTTP Headers

What is a JSON Web Token (JWT)?

Server-Side JWT Handshake (Node.js)

const WebSocket = require('ws');
const url = require('url');

const wss = new WebSocket.Server({ noServer: true });

wss.on('connection', function connection(ws, request) {
  const userId = request.userId; // Set during handshake verification
  console.log(`Client ${userId} connected`);

  ws.on('message', function incoming(message) {
    console.log(`Received from ${userId}: ${message}`);
  });

  ws.on('close', () => console.log(`Client ${userId} disconnected`));
});

// This is where you would integrate with an HTTP server
// For simplicity, we'll simulate the handshake here.

// Simulate an HTTP server upgrade listener
// In a real app, this would be an http.Server.on('upgrade')
function handleUpgrade(request, socket, head) {
  const pathname = url.parse(request.url).pathname;

  if (pathname === '/ws') {
    const token = new URLSearchParams(url.parse(request.url).query).get('token');
    
    // --- Simulate JWT verification ---
    if (token === 'valid_jwt_123') {
      request.userId = 'user_1'; // Attach user info to request
      wss.handleUpgrade(request, socket, head, function done(ws) {
        wss.emit('connection', ws, request);
      });
    } else {
      console.log('Invalid JWT. Connection rejected.');
      socket.destroy();
    }
  } else {
    socket.destroy();
  }
}

// Example usage (not a full http server, just for demonstration)
const mockRequest = {
  url: '/ws?token=valid_jwt_123',
  headers: { 'upgrade': 'websocket', 'connection': 'upgrade' }
};
const mockSocket = { 
  destroy: () => console.log('Socket destroyed (connection rejected)') 
};
const mockHead = Buffer.alloc(0);

console.log('Attempting connection with valid token...');
handleUpgrade(mockRequest, mockSocket, mockHead);

// Attempt connection with invalid token
const mockInvalidRequest = {
  url: '/ws?token=invalid_jwt',
  headers: { 'upgrade': 'websocket', 'connection': 'upgrade' }
};
const mockInvalidSocket = { 
  destroy: () => console.log('Socket destroyed (connection rejected)') 
};
console.log('\nAttempting connection with invalid token...');
handleUpgrade(mockInvalidRequest, mockInvalidSocket, mockHead);

Authorization: Who Can Do What?

Message-Level Authorization (Node.js)

const WebSocket = require('ws');

// Simulate a WebSocket server for demonstration
const wss = new WebSocket.Server({ port: 8080 });

// In a real application, user info (like roles) would be
// stored in the ws object after successful authentication.
const connectedClients = new Map(); // Map ws -> { userId, role }

wss.on('connection', function connection(ws) {
  // Simulate authenticated user and their role
  const userId = `user_${Math.floor(Math.random() * 100)}`;
  const role = (userId === 'user_10') ? 'admin' : 'member';
  connectedClients.set(ws, { userId, role });

  console.log(`Client ${userId} (${role}) connected.`);
  ws.send(`Welcome, ${userId}! Your role is ${role}.`);

  ws.on('message', function incoming(message) {
    const clientInfo = connectedClients.get(ws);
    const msg = message.toString();

    console.log(`Received from ${clientInfo.userId}: ${msg}`);

    // --- Authorization Check ---
    if (msg.startsWith('/delete') && clientInfo.role !== 'admin') {
      ws.send('Error: You are not authorized to delete messages.');
      console.log(`${clientInfo.userId} (member) tried to delete.`);
    } else if (msg.startsWith('/delete') && clientInfo.role === 'admin') {
      ws.send('Message deleted successfully!');
      console.log(`${clientInfo.userId} (admin) deleted a message.`);
      // In a real app, delete logic would go here
    } else {
      // Broadcast message to others or process normally
      wss.clients.forEach(function each(client) {
        if (client !== ws && client.readyState === WebSocket.OPEN) {
          client.send(`${clientInfo.userId}: ${msg}`);
        }
      });
      ws.send(`You said: ${msg}`);
    }
  });

  ws.on('close', () => {
    const clientInfo = connectedClients.get(ws);
    console.log(`Client ${clientInfo.userId} disconnected.`);
    connectedClients.delete(ws);
  });
});

console.log('WebSocket server started on port 8080. Try connecting with a WebSocket client!');
console.log('Simulated user_10 is an admin, others are members.');

Auth & Auth Quick Check

Recap: Secure Connections