Providing auth header with SockJS

spring rest model-view-controller websocket sockjs
L Morris picture L Morris · Sep 4, 2015 · Viewed 18.4k times · Source

I have a Spring MVC server that provides a bunch of REST endpoints as well as a websocket endpoint. Everything except the login endpoint requires authentication. I'm using JWT to authenticate requests coming from the client.

When the user logs in I'm returning an X-AUTH-TOKEN header, containing the JWT token. This token is then passed in the same header on every request to the server. This all works fine for the REST endpoints, but I can't figure out how to do this on the websocket.

I'm using SockJS, and when I open the connection:

var socket = new SockJS('/socket/updates', null, {});

This causes a GET request to /socket/updates/info?t=xxx which returns a 403 (as everything requires auth by default).

Ideally I'd simply send my X-AUTH-TOKEN header on any XHR requests SockJS makes, but I can't see any way of adding headers looking at the API.

Worst case I can change SockJS to do this, but I'm wondering whether this functionality has been deliberately left out? I know SockJS doesn't support cookies for security reasons but that's not what I'm trying to do.

Also, for the sake of a test I did allow the info endpoint to have anonymous access but then it 403's on a bunch of other endpoints - it feels more elegant to simply pass in auth details on these requests than poke holes in my server security.

Any help appreciated.

Cheers

Answer

Raman picture Raman · Sep 10, 2016

You cannot set the header from SockJS. Not because SockJS does not have this functionality, but because browser makers don't expose this API to Javascript. See:

https://github.com/sockjs/sockjs-client/issues/196

For a workaround, see JSON Web Token (JWT) with Spring based SockJS / STOMP Web Socket.

Related questions

Spring RestTemplate GET with parameters

I have to make a REST call that includes custom headers and query parameters. I set my HttpEntity with just the headers (no body), and I use the RestTemplate.exchange() method as follows: HttpHeaders headers = new HttpHeaders(); headers.set("Accept", "…

Read More
How to set an "Accept:" header on Spring RestTemplate request?

I want to set the value of the Accept: in a request I am making using Spring's RestTemplate. Here is my Spring request handling code @RequestMapping( value= "/uom_matrix_save_or_edit", method = RequestMethod.POST, produces="application/json" ) public @ResponseBody …

Read More
Spring MVC - How to return simple String as JSON in Rest Controller

My question is essentially a follow-up to this question. @RestController public class TestController { @RequestMapping("/getString") public String getString() { return "Hello World"; } } In the above, Spring would add "Hello World" into the response body. How can I return a String as …

Read More