Stomp web socket client authentication

Question

I have a ruby ​​on rails application deployed to powerbox. I need to somehow protect websockets in my application. I use stomp websockets, is there a way to authenticate users while they are making a connection to a web connection? I could use the username and password options, but they are currently ignored. Is there any other way to authenticate this connection? Thanks!

Answer 1

You can authenticate a message in Stomplet using a session and a stored token. To do this, you need to configure Rails to use the Torquebox session store. This can be done using an initializer, for example config/initializers/torquebox_init.rb :

 AppName::Application.config.session_store :torquebox_store 

Now Stomplet will have access to the session. Here is a Stomplet example that uses a session parameter :authentication_token to map User authentication_token in the database. Authentication token is checked for subscription, message sending and cancellation:

 require 'torquebox-stomp' class StompletDemo def initialize() super @subscribers = [] end def configure(stomplet_config) end def on_message(stomp_message, session) token = session[:authentication_token] if is_authenticated?( token ) @subscribers.each do |subscriber| subscriber.send( stomp_message ) end end end def on_subscribe(subscriber) session = subscriber.session if is_authenticated?(session[:authentication_token]) @subscribers << subscriber end end def on_unsubscribe(subscriber) session = subscriber.session if is_authenticated?(session[:authentication_token]) @subscribers.delete( subscriber ) end end def is_authenticated?(token) User.where( authentication_token: token ).exists? end end 

Now you only need to make sure that session[:authentication_token] authentication is set during user authentication session[:authentication_token] . This will mainly be installed in the controller:

  # user has successfully authenticates session[:authentication_token] = @user.authentication_token 

Answer 2

For other people having this problem, I solved it.

https://gist.github.com/j-mcnally/6207839

Basically, the token system did not scale for me, especially since I use the program. If you want to place your website in the word chrome extension, it's easier just to enter the username / password for stomping and manage your virtual subscriber sessions in the stoppet. It also allows you to do some fun things as far as you click.