TBD54566975/dwn-server

Require a `Message` to authorize a `SocketConnection` open.

Opened this issue · 0 comments

Currently given in PR #107 for WebSocket long running subscriptions, anyone can connect and keep a socket alive.

We have a few options:

  1. Wait a timeout period for any accepted DWN message to arrive.
  2. Wait a timeout period for a Subscribe type message to arrive and a subscription to be accepted by the DWN.
  3. Require any message with the web socket connection request and reject if not supplied or if message is not accepted by the DWN.
  4. Require a Subscribe message with the web socket connection request and reject if not supplied or if message is not accepted by the DWN.

We currently allow only on/off wrt subscription support in the DWN, we should consider potentially allowing some finer grained config options such as disallowing anonymous subscriptions or public unauthed subscriptions.

But any of the above will work with the tenant gate mechanism in place which should be enough for now.

I really like requiring the message with the initial request, however you cannot pass custom headers with a socket connection request, the common mechanism is to pass a token in the query parameters of the request. I don't mind that, but there is the caveat that the query parameters are not protected by TLS.

The only downside of 1 or 2 is that you are keeping a connection open for a timeout while waiting to receive the message through the socket.