Authentication for Websockets
summary
Demo shows togetherjs clients can be impersonated with two lines of code by setting another client ID and relaying actions as that user using a rube am WebSocket server. Claim: WebSockets lack built‑in client auth so the app must verify identity during the WebSocket handshake by checking the app’s session header values. Implementation copies Rack session verification, rejects connections when IDs or display names mismatch, and the demo closes the socket as intended.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:48Web Socket Client Authentication
- 1:42Impersonation Demo
- 6:09Heroku's websocket auth page
- 7:50authentication hub
related talks
46mPassword-less apps: implementing WebAuthN
40mSocket to me
01h 02mModern Authentication
46mAuthentication Without Authentication
40mGoing passwordless with Web Authentication
12mAuthentication and Authorization in Next.js
33mAuthenticate and authorize users “your way” when they access your appl & platf
57mSecurity and Identity: Ruby, CAS, and OpenID