Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature] Add hook Before Websocket Connection Is Accepted #831

Closed
Fede91 opened this issue May 21, 2024 · 1 comment
Closed

[Feature] Add hook Before Websocket Connection Is Accepted #831

Fede91 opened this issue May 21, 2024 · 1 comment
Labels
enhancement New feature or request

Comments

@Fede91
Copy link

Fede91 commented May 21, 2024

Is your feature request related to a problem? Please describe.

The current system does not allow for user authentication during the WebSocket connection process. This creates a security risk as there's no way to check if an individual user is authorized to connect to Cheshire Cat.

Describe the solution you'd like

I would like to add a hook before the WebSocket connection is accepted. This hook will allow for user authentication by checking a session token sent as a query parameter in the WebSocket connection URL. If the user is authenticated, the connection will be accepted; otherwise, it will be rejected.

Describe alternatives you've considered

Currently, there are no alternatives to perform this specific check for each individual user. Using an API key to authorize the entire client is not effective because if a user intercepts the key, they could use it in any other client.

Additional context

I am working on a project where multiple users will have their own profiles and will be able to interact with the Cheshire Cat. My idea is to send the session token as a query parameter in the WebSocket connection URL and develop a plugin to either accept or reject the connection request based on the validity of the session token.

@Fede91 Fede91 added the enhancement New feature or request label May 21, 2024
@pieroit
Copy link
Member

pieroit commented May 21, 2024

@Fede91 thanks for your suggestion
This is already under work under this PR:
#794

More details in this issue
#690 (comment)

You will be able to customize both http and websocket auth ;)

Closing this issue!

@pieroit pieroit closed this as completed May 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants