{"action":"created","issue":{"url":"https://api.github.com/repos/rstoyanchev/spring-websocket-portfolio/issues/57","labels_url":"https://api.github.com/repos/rstoyanchev/spring-websocket-portfolio/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/rstoyanchev/spring-websocket-portfolio/issues/57/comments","events_url":"https://api.github.com/repos/rstoyanchev/spring-websocket-portfolio/issues/57/events","html_url":"https://github.com/rstoyanchev/spring-websocket-portfolio/issues/57","id":96073744,"number":57,"title":"Add sample code for cross domain websocket implementation including authentication","user":{"login":"rob-baily","id":8356916,"avatar_url":"https://avatars.githubusercontent.com/u/8356916?v=3","gravatar_id":"","url":"https://api.github.com/users/rob-baily","html_url":"https://github.com/rob-baily","followers_url":"https://api.github.com/users/rob-baily/followers","following_url":"https://api.github.com/users/rob-baily/following{/other_user}","gists_url":"https://api.github.com/users/rob-baily/gists{/gist_id}","starred_url":"https://api.github.com/users/rob-baily/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rob-baily/subscriptions","organizations_url":"https://api.github.com/users/rob-baily/orgs","repos_url":"https://api.github.com/users/rob-baily/repos","events_url":"https://api.github.com/users/rob-baily/events{/privacy}","received_events_url":"https://api.github.com/users/rob-baily/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-07-20T14:14:25Z","updated_at":"2015-07-28T20:46:16Z","closed_at":null,"body":"@rstoyanchev and @rwinch, I have been doing research on how to handle cross domain websockets that need to handle authentication as well and I have yet to find any definitive answers in Spring documentation, on StackOverflow or other other internet sources.  I've seen posts saying things like open the socket and then wait for an authenticated message and otherwise close the socket.  The main issue seem to be a restriction from web based implementations on setting authentication information in the initial headers.\r\n\r\nI believe in today's world this is a more common use case.  I can see that in the example here it may be desirable to offer a quote service that others could include on their sites and give them information based on the user credentials and role.\r\n\r\nI'd like to add some sample code to this (or by itself if that makes more sense) that others can use to follow and I wanted to get something that is considered secure.  It also seems like we may need to consider something with or without SockJS since that appears to use iFrames in some cases.  So if you have some advice about how to start this I would go ahead and take a crack at the code.  I've done my own hacking to add an authentication token on the initial URL but that seems like it might not be the most secure option.\r\n\r\nSorry if this is wrong way to go about it but it seemed like a good avenue to get advice from the experts and help add to the community knowledge."},"comment":{"url":"https://api.github.com/repos/rstoyanchev/spring-websocket-portfolio/issues/comments/125749647","html_url":"https://github.com/rstoyanchev/spring-websocket-portfolio/issues/57#issuecomment-125749647","issue_url":"https://api.github.com/repos/rstoyanchev/spring-websocket-portfolio/issues/57","id":125749647,"user":{"login":"rstoyanchev","id":401908,"avatar_url":"https://avatars.githubusercontent.com/u/401908?v=3","gravatar_id":"","url":"https://api.github.com/users/rstoyanchev","html_url":"https://github.com/rstoyanchev","followers_url":"https://api.github.com/users/rstoyanchev/followers","following_url":"https://api.github.com/users/rstoyanchev/following{/other_user}","gists_url":"https://api.github.com/users/rstoyanchev/gists{/gist_id}","starred_url":"https://api.github.com/users/rstoyanchev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rstoyanchev/subscriptions","organizations_url":"https://api.github.com/users/rstoyanchev/orgs","repos_url":"https://api.github.com/users/rstoyanchev/repos","events_url":"https://api.github.com/users/rstoyanchev/events{/privacy}","received_events_url":"https://api.github.com/users/rstoyanchev/received_events","type":"User","site_admin":false},"created_at":"2015-07-28T20:46:16Z","updated_at":"2015-07-28T20:46:16Z","body":"> From what I can tell there is no best practice for how to ensure that a cross domain socket request is authenticated, especially when STOMP is involved.\r\n\r\nHm I'm not sure what you mean. The authentication is standard Spring Security web URL-based. It protects the WebSocket/SockJS endpoint regardless of what sub-protocol is used on top (i.e. the use of STOMP vs anything should not matter).\r\n\r\n> It seems that you can only pass in information on the handshake for the websocket and you can't add an actual authorization header when you are using a web browser client.\r\n\r\nNot sure what you mean by that either. Once authenticated, the WebSocket/SockJS session contains the Principal and you can [apply authorization with Spring Security 4](http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#websocket) based on that.\r\n\r\n\r\n\r\n"}}