3

I'm using a secure WebSocket connection (wss://...) for data transfer to and from a single-page app.

Once a client has been authenticated, should I be passing some sort of authentication token with each message as I would with a typical REST API (something like this)? Or is it safe to assume the integrity of the connection while it's active?

1
  • how would they become de-authenticated w/o losing the connection? – dandavis Jul 29 '17 at 0:18
2

A WebSocket is a persistent connection, unlike a REST call. If you've set up a secure connection, the authentication happens as part of the handshake, so sending an authentication token with every message is likely to be unnecessary overhead.

That said, sending an authentication token in specific messages can be useful for session management. For instance, after establishing the connection, the server could pass a token/authentication key for that session back to the client. If the client loses connection and then manages to reconnect, the token can be used to check if the client is the same one.

2

You'll need authentication if you want to ensure the caller of your REST API is the same as the websocket client, as they're under separate TLS connections.

You don't need to do authentication for the communication of a single websocket connection, as it is under a single TLS connection so the data integrity is ensured by TLS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.