Laravel-swoole: How to allow only authenticated users to connect to websocket

[Abbotton]

Make sure you read Issues Guideline and answer these questions before submitting your issue. Thanks!
(Any non-English issues will be closed immediately.)

1. Please provide your PHP and Swoole version. (php -v and php --ri swoole)

PHP 7.2.4 (cli) (built: Apr 17 2018 17:59:37) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.2.4, Copyright (c) 1999-2018, by Zend Technologies

swoole support => enabled
Version => 4.2.9
Author => Swoole Group[email: [email protected]]
coroutine => enabled
epoll => enabled
eventfd => enabled
signalfd => enabled
cpu_affinity => enabled
spinlock => enabled
rwlock => enabled
sockets => enabled
openssl => OpenSSL 1.0.2k-fips  26 Jan 2017
pcre => enabled
zlib => enabled
mutex_timedlock => enabled
pthread_barrier => enabled
futex => enabled
mysqlnd => enabled
async_redis => enabled

Directive => Local Value => Master Value
swoole.enable_coroutine => On => On
swoole.aio_thread_num => 2 => 2
swoole.display_errors => On => On
swoole.use_namespace => On => On
swoole.use_shortname => On => On
swoole.fast_serialize => Off => Off
swoole.unixsock_buffer_size => 8388608 => 8388608

1. Please provide your Laravel/Lumen version.
   Laravel v5.7.15
2. Which release version of this package are you using?
   ^2.5
3. What did you do? If possible, provide a recipe for reproducing the error.

- pure laravel project
- installed laravel/passport package
- installed swooletw/laravel-swoole package

1. What did you expect to see?

I just want the authenticated user to communicate with the back end using websocket and the backend server can get current user infomation.

1. What did you see instead?

The backend server can't get the current user，more explanation see blow.

---

Explain

• First, sorry my bad English.

• In my current project, the client is a pure HTML 5 page, that means this page is not in the laravel project, of course, will not use blade template engine.

• Now, I just want the authenticated user to communicate with the back end using websocket, so first I get access_token by requesting the `auth/token'interface, and then I make a websocket connection.

• But I found a serious problem. I can't wrap access_token in the header of an HTTP request, which means that the server doesn't know who is doing the websocket connection.

• I spent part of my time solving this problem by consulting the information on the Internet, but I don't think my solution is the best. So, is there a better solution?

[Abbotton]

It seems that @albertcht no longer maintains this project. The links below are my solutions. If you have better solutions, please feedback. thx

My Solution

[albertcht]

Hi @Abbotton ,

I think I would classify this issue to a personal question instead of bug.

And yes, indeed, recently I put less effort to this project because I got other things to work on in my real life. However, that doesn't mean this project is no longer maintained.

The reality is I need to get the balance between my life and work. I will continue the development for this project, but I can't guarantee any promised deadline for any feature though. But basically, I will still try to fix real bug issues first with my limited time.

[Abbotton]

I'm very sorry for what I just said, and I'm deeply grateful to you for developing this great package. I just want to know if there is a better way to solve my problem.

Imagine that the customer logged in to App and successfully connected to websocket, but the server didn't know who the user was.

In my ERP project, every factory employee has an App workbench, and the financial staff may send some payment processing results to the designated employees, etc. In this case, what should I do?

thx.

[albertcht]

I take a look at your description roughly and I find something strange. You should able to bring your access token in to the header for your http request before a websocket connection is really established.

And then you can implement your own logic about how to authenticate the user with the request in the middleware for websocket like what you've done in your gist.

[Abbotton]

I think I know how to do it. After I finish processing, I will update the gist and close the issue. Thank you again.

[fractalzombie]

@Abbotton how it's going with issue?

[noecs]

Hey, my program is also separated from the front and back, using the access_token of the passport for api requests. Now we need to implement a Websocket chat room function. The JavaScript Websocket does not have the Authorization API, but there is a Websocket sub-protocol when setting up the handshake. After reading the swoole documentation, I felt that I should put the authorization in the onHandShake callback. When requesting a handshake, the access_token should be placed in the self-protocol and sent to the server for verification. As I imagined. I got access_token on the server side onHandShake. But I can't currently use this token string for validation. Laravel's own token validation is the Authorization in http.

[albertcht]

A websocket connection is upgraded from an HTTP request. Bring your auth info on that request. And you can get the request from that via middleware in this package. See more detail here: https://github.com/swooletw/laravel-swoole/wiki/7.-Websocket#middleware-for-onopen-event-request

However, you need to customize your auth logics in the miidleware, that's it.

[Abbotton]

sorry guys. i'm so busy and I couldn't find a better solution, using Sec-WebSocket-Protocol is the same as the one I used before.