Configuring authentication headers for WebSocket c

Question

IIUC, when I create a WebSocket an HTTP request is sent to the specified URL, containing an upgrade request. Is it typicaly to pass authentication information along with this upgrade request, or should it be performed separately?

var websocket = new WebSocket("ws://domain:port/foo"); // Can I include authentication headers with the initial upgrade HTTP request?

Answer 1

The WebSocket RFC standard doesn't define any protocol-specific client authentication mechanism but mentions that HTTP authentication is a possible option:

10.5. WebSocket Client Authentication

This protocol doesn't prescribe any particular way that servers can authenticate clients during the WebSocket handshake. The WebSocket
server can use any client authentication mechanism available to a
generic HTTP server, such as cookies, HTTP authentication, or TLS
authentication.

The standard for http URLs prescribes a form which includes the login credentials within the URL. The form is http://username:[e-mail]/file. But this syntax is not supported by all browsers because, frankly, it was a really bad idea.

The WebSocket API does not expose any features intended for HTTP client authentication. That means web browsers are supposed to provide authentication the way they usually do: With the URL syntax above when they decide to support it or by showing a popup to the user where they enter their login credentials.

Answer 2

You should do the authentication through web, return a cookie and then connect to the websocket server again, carrying the cookie. The WS server can validate the cookie

If there is no cookie based authentication or it is just not possible (like the WS server in another domain), you will have to create your own request-response messages for login.