I have a website (https) that has basic auth enabled for /token subdir I have websocket ws going through Nginx to become wss

I want to create a bi-directional api on the websocket so that end users have view access to everything, but write access requires a token obtained via an AJAX request to /token which is password protected via basic auth through Nginx.

  • client side should not prompt for password unless command requiring write access is made
  • on write access client side script will check for locally stored token and either request one or send existing one to server in write access api call
  • if client side code is compromised a password protected token from /token would still be required

As far as I can tell, this seems secure ... am I missing something?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.