This question is related to this question I asked

To summarise, I'm playing with websockets at the moment and I'm trying to understand how to authenticate a client connecting to the server using a websocket connection.

On a normal connection, I use token based authentication, I basically just get a token from the server after I log in. Every time I make a request to the server, I put it in a custom header called Authentication which my server reads it from there.

With websockets, this doesn't work because websockets do not have custom headers. I'm left with two options to pass this token.

1) putting the token in the query string - obviously not a great option. Token can be logged by server etc.

2) putting the token in a cookie - this works but only when the client and server sit on the same domain. There's also other restrictions like the client has to be a browser and support cookies etc.

Anyway, the other question is trying to find a solution, this question is about understanding why this is a problem. Why doesn't websockets support custom headers? It's unlikely to be an oversight - websockets and token based authentication are both fairly mature technologies. Is there some sort of security issue with allowing custom headers during the websocket connection?


Why doesn't websockets support custom headers? It's unlikely to be an oversight ...

I agree that this looks like an oversight.

This actually does not surprise me since in my opinion the implementation of WebSockets inside the browser was not well-thought-out in the first place. The most glaring issue is that WebSockets ignore the same origin policy or CORS restrictions, i.e. the server needs to be explicitly check the origin of the connection (Origin header) because otherwise Cross-Site WebSocket Hijacking would be possible.

This insecure-by-default design is in contrast to the secure-by-default behavior of CORS which was created a bit earlier than WebSockets. Given this obvious security problem I doubt that any security considerations played a role in not allowing custom headers as in XHR.

Note that the WebSockets protocol itself supports custom headers since it starts with a HTTP handshake similar to a normal HTTP request. It is only the browser API which is missing the ability to use custom headers.

  • damn - so in your opinion, what would be the best way to secure a websocket connection on seperate domains? Some sort of use-once only token in the query string? – stickman Nov 27 '17 at 4:05
  • @stickman: This question from the comment is related to your original question but not actually part of it. Please don't ask new question inside a comment but start a new question instead which contains all needed information. – Steffen Ullrich Nov 27 '17 at 4:11
  • thanks, the question in the comment is pretty much what I asked here (stackoverflow.com/questions/47495817/…). So if you got an answer, please answer there i guess. – stickman Nov 27 '17 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.