I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to WebSocket (code snippet used to handle upgrade in NodeJS).
The problem lays in GET request which is not supposed to be used in authentication (mentioned here and here). I would need to send password via path or query parameters in URL e.g.
wss://example.com/username/password123 and then validate it on server side.
My idea is to encrypt the password on client side with Argon2 (using salt) and then send it with WebSocket upgrade request (GET) over HTTPS as url path parameter to the server which will validate it with database entry. I know that this question is similar to this one, but it doesn't cover password encryption. Is that enough to say that it's a good and secure approach?
Thanks for help.