I have a website (https) that has basic auth enabled for
I have websocket ws going through Nginx to become wss
I want to create a bi-directional api on the websocket so that end users have view access to everything, but write access requires a token obtained via an AJAX request to
/token which is password protected via basic auth through Nginx.
- client side should not prompt for password unless command requiring write access is made
- on write access client side script will check for locally stored token and either request one or send existing one to server in write access api call
- if client side code is compromised a password protected token from
/tokenwould still be required
As far as I can tell, this seems secure ... am I missing something?