Basic authentication for websites

Question

When I create a new websocket using chrome

new WebSocket('ws://gert: passwd@127.0.0.1 :8001/dbname') 

Nodejs server gets

 GET /dbname HTTP/1.1 Upgrade: WebSocket Connection: Upgrade Host: 127.0.0.1:8001 Origin: http://127.0.0.1:8000 Sec-WebSocket-Key1: ' 5 5) 4 1e a9 9 0 19 Sec-WebSocket-Key2: 3000909100 Q 

How to get gert and passwd?

Answer 1

it seems that chrome does not pass the basic auth data in the ws headers. Why not log in to / pwd as part of the url query string? (and use secure wss)

Answer 2

Chrome did not pass the authorization header as part of the update request. This led to authentication failure.

The problem seems to be fixed in the latest chrome here

Answer 3

The Authorization header was not mentioned in the WebSocket specification prior to Hybi-13 . Chrome implements hybi-00 and hybi-10 (depending on the version of Chrome), so it did not require implementation.

Now that it’s mentioned in the protocol, perhaps Google will implement it, but I wouldn’t guarantee that “user: pass @ ...” in the URI will definitely have a way to do this, this may require changing the API of the WebSocket browser.

Answer 4

SSL

I found this link in Quora .

I agree that you can use SSL and just send these credentials as the first message.

Socket.io

You can also use socket.io, which also has web descriptor wrapping for authorizing

Answer 5

Chrome sends network connected cookies. If you have a session cookie, you can use the session cookie to identify the user initiating the connection to the web server.