3 ms·

> AFAIK, websockets doesn't do authentication? Websocket allows for custom header and query parameters which make it possible to run a basic authentication sch

> AFAIK, websockets doesn't do authentication? Websocket allows for custom header and query parameters which make it possible to run a basic authentication scheme and later on additional autorisation in the message themselves if really necessary. > And the encryption it does is minimal, optional xor with a key disclosed in the handshake. It does do framing. Web Secure Socket (WSS) is the TLS encrypted version of Websockets (WS) (similar to HTTP vs. HTTPS).

fyrn_ 1y ago
Worth noting that wbesockets in the browser don't allow custom headers and custom header support is spotty accross sever impls. It's just not exposed in the javascript API. There has been an open chrome bug for that for like 15 years
- LunaSea 1y ago
  > Worth noting that wbesockets in the browser don't allow custom headers They do during the initial handshake (protocol upgrade from HTTP to WebSocket). Afterwards the message body can be used to send authorisation data. Server support will depend on tech but Node.js has great support.
  - fyrn_ 1y ago
    https://github.com/whatwg/websockets/issues/16 https://github.com/whatwg/websockets/issues/16 No, I don't think you get it. `new Websocket()` from JS takes no arguments for headers. You literally can't send headers during the handshake from JS. https://developer.mozilla.org/en-US/docs/Web/API/WebSocket/WebSocket https://developer.mozilla.org/en-US/docs/Web/API/WebSocket/W... Actually will look into using the subprotocol as a way to do auth, but most impls in the wild send the auth as the first message. The fact the protocol in theory supports it doesn't really matter much since no browser implements that part of the spec.
toast0 1y ago
Ok, so what is WebSockets providing that you don't get from TLS? In a browser context, I see the value; browsers are very constrained, so you use what's offered. In a non-browser context, I don't see the value. If you need to support mixed use, you could go either way and that's fine, too.

fyrn_ 1y ago

Worth noting that wbesockets in the browser don't allow custom headers and custom header support is spotty accross sever impls. It's just not exposed in the javascript API. There has been an open chrome bug for that for like 15 years

LunaSea 1y ago
> Worth noting that wbesockets in the browser don't allow custom headers They do during the initial handshake (protocol upgrade from HTTP to WebSocket). Afterwards the message body can be used to send authorisation data. Server support will depend on tech but Node.js has great support.
- fyrn_ 1y ago
  https://github.com/whatwg/websockets/issues/16 https://github.com/whatwg/websockets/issues/16 No, I don't think you get it. `new Websocket()` from JS takes no arguments for headers. You literally can't send headers during the handshake from JS. https://developer.mozilla.org/en-US/docs/Web/API/WebSocket/WebSocket https://developer.mozilla.org/en-US/docs/Web/API/WebSocket/W... Actually will look into using the subprotocol as a way to do auth, but most impls in the wild send the auth as the first message. The fact the protocol in theory supports it doesn't really matter much since no browser implements that part of the spec.

toast0 1y ago

Ok, so what is WebSockets providing that you don't get from TLS? In a browser context, I see the value; browsers are very constrained, so you use what's offered. In a non-browser context, I don't see the value. If you need to support mixed use, you could go either way and that's fine, too.