WebSocket header authentication
jirenius opened this issue · 1 comments
jirenius commented
Issue
The headerAuth configuration (or --headauth flag) is currently only used on HTTP calls, and ignored for WebSocket.
It should be possible to configure resgate to also use the header authentication resource for new WebSocket connection.
Notes
To prevent breaking existing deployments of resgate, the feature should not be activated by default.
It should be added as a new setting:
// Header authentication resource method for websocket connections.
// Prior to responding to a websocket connection, this resource method will be
// called, allowing an auth service to set a token using
// information such as the request headers.
// Missing value or null will disable websocket header authentication.
// Eg. "authService.headerLogin"
"wsHeaderAuth": null,| Option | Description | Default value |
|---|---|---|
-t, --wsheadauth <method> |
Resource method for WebSocket header authentication |