Authenticate using query string
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 6.1k
- Forks
- 1.7k
- PR merge metrics
- No merged PRs in 30d
Description
I am using the query string to authenticate users. So first the users request a bearer token via a REST endpoint, and then send this token as a query string with the websocket url.
e.g.: ws://mysocket.com:1234/testroute?token=BEARER_TOKEN
My problem is that as of now, I don't seem to be able to reject the connection during the handshake. First the connection is opened, and then I can close the connection inside the OnOpen method.
Is there a better way to do this? I want to keep a bearer token authentication.
If not, it would be nice to have an extra validator for the query strings of expose the CustomHandshakeRequestChecker so we can write our own.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the server handshake flow and the OnOpen callback described in the issue, then inspect the CustomHandshakeRequestChecker entry point. Determine how query-string bearer tokens could be validated before the connection opens, or how that checker could be exposed; done means invalid tokens are rejected during the handshake while valid connections continue normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, backend-api-design
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100