I'm using a secure WebSocket connection (wss://...) for data transfer to and from a single-page app.

Once a client has been authenticated, should I be passing some sort of authentication token with each message as I would with a typical REST API (something like this)? Or is it safe to assume the integrity of the connection while it's active?

  • how would they become de-authenticated w/o losing the connection?
    – dandavis
    Jul 29, 2017 at 0:18

2 Answers 2


A WebSocket is a persistent connection, unlike a REST call. If you've set up a secure connection, the authentication happens as part of the handshake, so sending an authentication token with every message is likely to be unnecessary overhead.

That said, sending an authentication token in specific messages can be useful for session management. For instance, after establishing the connection, the server could pass a token/authentication key for that session back to the client. If the client loses connection and then manages to reconnect, the token can be used to check if the client is the same one.


You'll need authentication if you want to ensure the caller of your REST API is the same as the websocket client, as they're under separate TLS connections.

You don't need to do authentication for the communication of a single websocket connection, as it is under a single TLS connection so the data integrity is ensured by TLS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .