Open wbobeirne opened 4 years ago
+1
new WebSocket(address, 'Bearer,' + token )
Subprotocol is invalid.
How it's work?
It should be
ws = new WebSocket(address, ['Bearer', token])
Browser concatenates subprotocol header by itself. No spaces or commas are allowed in header values.
Hey there, I see there are some docs about passing authorization using the
Sec-Websocket-Protocol
header. While this is a clever workaround, it doesn't appear as though it'll actually work for websockets started from the browser. From the MDN article on websockets, only registered IANA subprotocols can be passed. Attempting to passBearer, 123
results inWas this implemented with browser compatibility in mind? Or was the idea that cookies would be the only browser-friendly authorization method?