Gorilla Cookie Authenticated Website

Question

Here is my setup: I am building a service (using Negroni and Gorilla) with a username, where when I log in, the user receives a session cookie that the server uses to authorize secure endpoints. One of the secure endpoints allows a user / client to open a web server with a server, for example:

app := negroni.New() r := mux.NewRouter() r.HandleFunc("/auth/connection", func(rw http.ResponseWriter, req *http.Request) { // authorize request using req.Cookie("session_id") // create websocket conn, err := upgrader.Upgrade(rw, req, nil) if err != nil { panic(err) } defer conn.Close() // do stuff... }) app.UseHandler(r) app.Run(":3000") 

However, req.Cookies() always empty, that is, I cannot resolve any "/auth/connection" requests - and I'm pretty sure that this is not a problem with the websocket client (if you are interested, m testing it with this Python package: https://github.com/liris/websocket-client ). Am I right for websocket authentication?

Any help / advice would be greatly appreciated!

Answer 1

The server processes the WebSocket handshake as a normal HTTP request until the moment Upgrade is called. Use any authentication that you will use for regular HTTP requests.

The Gorilla package does not play in the line of code with the auth comment.