search

tmc / grpc-websocket-proxy

A proxy to transparently upgrade grpc-gateway streaming endpoints to use websockets
MIT License
553 stars 72 forks source link

Passing authentication from browser JS websocket #20

Open wbobeirne opened 4 years ago

wbobeirne commented 4 years ago

Hey there, I see there are some docs about passing authorization using the Sec-Websocket-Protocol header. While this is a clever workaround, it doesn't appear as though it'll actually work for websockets started from the browser. From the MDN article on websockets, only registered IANA subprotocols can be passed. Attempting to pass Bearer, 123 results in

VM3291:1 Uncaught DOMException: Failed to construct 'WebSocket': The subprotocol 'Bearer, 123' is invalid.

Was this implemented with browser compatibility in mind? Or was the idea that cookies would be the only browser-friendly authorization method?

AKopytenko commented 4 years ago

+1 new WebSocket(address, 'Bearer,' + token ) Subprotocol is invalid.

How it's work?

Goobs commented 3 years ago

It should be 

ws = new WebSocket(address, ['Bearer', token])

Browser concatenates subprotocol header by itself. No spaces or commas are allowed in header values.