How to implement user authorization?

[caracal7]

How to implement reliable authorization? For example with passportJS or something like it.
And which is a proper way to manage user sessions with uWebSockets?

[Chathula]

+1

[mrlika]

It's a basic web server. It doesn't support middlewares like Passport.js. But you can implement almost everything on top of it. Read the documentation to understand how things work and go ahead!

[caracal7]

@mrlika
I understand that it is a basic web server). And I implemented very simple authentication but I'm looking for the best practices and close to real world examples.
For now I simply send message from client with login/password after WebSocket opened and set ws.logged = 'mylogin' on server.
But something tell me that it is not a very safe and secure way)

[mrlika]

I don't think that the best practiced are related to this project. They are related to HTTP protocol in general.

[mrlika]

I think that the cookies are the way to go:
https://devcenter.heroku.com/articles/websocket-security#authentication-authorization

[girng]

https://m.youtube.com/watch?v=OP30okjpCko

Best practise right there :)

😂😂🤣

[lagden]

@caracal7 and @Chathula

Use cookie (HttpOnly)

const {App} = require('uWebSockets.js')
const cookie = require('cookie')

const app = App()
app
  .ws('/*', {
    upgrade(res, req, context) {
      const _cookie = cookie.parse(req.getHeader('cookie'))
      // validate the cookie somehow
      // and set _logged true or false
      let _logged = true

      res.upgrade(
        {_logged},
        req.getHeader('sec-websocket-key'),
        req.getHeader('sec-websocket-protocol'),
        req.getHeader('sec-websocket-extensions'),
        context
      )
    },
    open(ws) {
      // disconnect if not logged
      if (!ws._logged) {
        ws.end()
        console.log('unauthorized', 'https://m.youtube.com/watch?v=OP30okjpCko')
        return
      }
    }
    // ...more code
  })
  .any('/*', (res, req) => {
    // set cookie
    res.writeHeader('Set-Cookie', '_token=jwt; SameSite=Strict; HttpOnly')
    res.end('cookie sample')
  })
  .listen('::', 3132, token => {
    console.info(token)
  })

[hst-m]

@lagden the point of the upgrade handler is to deny the request before the socket opens so you would want to update that

Here is JsonWebToken example

app.ws('/', {
   upgrade:(res, req, context) => {
      try { res.user = decodeJwtCookie(res, req, 'cookieName'); }
      catch { return res.writeStatus('401').end(); }
      res.upgrade({ uid: res.user._id }, req.getHeader('sec-websocket-key'), req.getHeader('sec-websocket-protocol'), req.getHeader('sec-websocket-extensions'), context);
   },
   open: ws => console.log('open-ws', ws.uid)
});


const getCookie = (res, req, name) => { res.cookies ??= req.getHeader('cookie'); return res.cookies && res.cookies.match(getCookie[name] ??= new RegExp(`(^|;)\\s*${name}\\s*=\\s*([^;]+)`))?.[2]; };
const decodeJwtCookie = (res, req, name) => require('jsonwebtoken').verify(getCookie(res, req, name), env.jwtSecret);

decodeJwtCookie throws error if cookie was not signed with correct secret, and code prevents websocket from opening with res.writeStatus('401').end() unauthorized

[dragonlobster]

you are right, i ran into the error. second edit, i tried i think it's ok now

[e3dio]

res.end() is invalid, there is no more response after Aborted. Return without handling response if (res.aborted) return;

[dragonlobster]

third try's a charm

[Wyzix33]

I've used https://github.com/panva/paseto it was simple to implement, and it seems to be better and faster than jwt

[lagden]

I did the boilerplate project. It's very small, simple and has an auth example.
https://github.com/lagden/boilerplate-ws

I hope it helps someone. 😉