{"action":"created","issue":{"url":"https://api.github.com/repos/gin-gonic/gin/issues/461","labels_url":"https://api.github.com/repos/gin-gonic/gin/issues/461/labels{/name}","comments_url":"https://api.github.com/repos/gin-gonic/gin/issues/461/comments","events_url":"https://api.github.com/repos/gin-gonic/gin/issues/461/events","html_url":"https://github.com/gin-gonic/gin/issues/461","id":111295397,"number":461,"title":"Websocket advanced example","user":{"login":"orangesoup","id":12503743,"avatar_url":"https://avatars.githubusercontent.com/u/12503743?v=3","gravatar_id":"","url":"https://api.github.com/users/orangesoup","html_url":"https://github.com/orangesoup","followers_url":"https://api.github.com/users/orangesoup/followers","following_url":"https://api.github.com/users/orangesoup/following{/other_user}","gists_url":"https://api.github.com/users/orangesoup/gists{/gist_id}","starred_url":"https://api.github.com/users/orangesoup/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/orangesoup/subscriptions","organizations_url":"https://api.github.com/users/orangesoup/orgs","repos_url":"https://api.github.com/users/orangesoup/repos","events_url":"https://api.github.com/users/orangesoup/events{/privacy}","received_events_url":"https://api.github.com/users/orangesoup/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-13T23:54:02Z","updated_at":"2015-10-14T00:32:46Z","closed_at":null,"body":"Hey!\r\n\r\nMy problem is a bit complex, but I hope someone can help me. I have an API server made with gin and an Angular app on client side. The authentication is done with JWT. So far so good, everything works.\r\n\r\nSince websocket doesn't support `authorization` header I thougt I'll make the websocket urls like this: `/ws/:token/whatever` and use a middleware to validate the token. This is working, no problem there.\r\n\r\nHere comes the problem though: Let's say I want to invalidate a user's tokens. I destroy them on server side, that's okay, but I also want to tell the user on the client side via websocket to remove the token from localStorage and then log him out. Obviously on a refresh, or state change, or whatever else the user would get `401` anyway, but I would like to sign him out still.\r\n\r\nThere is a basic websocket example in #51, but it doesn't solve my problem.\r\nBasically: how can I write to an exact websocket from another API call?\r\n\r\nExample: admin calls `/api/admin/user/sessions/clear`, posts the user id. This calls a function `ClearSessions()`. How can this `ClearSessions()` function also write to the user's websocket (`/ws/:token/whatever`)?\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/gin-gonic/gin/issues/comments/147891794","html_url":"https://github.com/gin-gonic/gin/issues/461#issuecomment-147891794","issue_url":"https://api.github.com/repos/gin-gonic/gin/issues/461","id":147891794,"user":{"login":"nazwa","id":4353913,"avatar_url":"https://avatars.githubusercontent.com/u/4353913?v=3","gravatar_id":"","url":"https://api.github.com/users/nazwa","html_url":"https://github.com/nazwa","followers_url":"https://api.github.com/users/nazwa/followers","following_url":"https://api.github.com/users/nazwa/following{/other_user}","gists_url":"https://api.github.com/users/nazwa/gists{/gist_id}","starred_url":"https://api.github.com/users/nazwa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nazwa/subscriptions","organizations_url":"https://api.github.com/users/nazwa/orgs","repos_url":"https://api.github.com/users/nazwa/repos","events_url":"https://api.github.com/users/nazwa/events{/privacy}","received_events_url":"https://api.github.com/users/nazwa/received_events","type":"User","site_admin":false},"created_at":"2015-10-14T00:32:46Z","updated_at":"2015-10-14T00:32:46Z","body":"Ha, sorry. You are absolutely right - forgot that sockets only send cookies around.\r\n\r\nKeep an authentication  flag for every socket and require the first message from client to contain the authentication token. If client sends anything else than a valid authentication token and connection is still marked (using that flag) as unauthenticated then you can assume it's not a legitimate connection and close it or ban it.\r\n\r\n\r\n\r\n\r\nAs for the map, something like this:\r\n\r\n```go \r\ntype OpenSocketsStruct struct {\r\n\tsync.Mutex\r\n\tlist map[in64]*websocket\r\n}\r\n\r\nfunc (p *OpenSocketsStruct) Add(id int64, ws *websocket) {\r\n    p.Lock()\r\n    defer p.Unlock()\r\n\r\n    p.list[id] = ws\r\n}\r\n\r\n```\r\n\r\nAnd then keep it somewhere that's accessible to your handlers.Obviously any reads and deletes also need to obtain the mutex as maps are not thread safe."}}