Nest: websocket authentication with password and passwort-jwt

[loicgeek]

Hi there! I love the way Nestjs bring us Typescript in Nodejs , it very easy and also well documented
Right now I'm building a REST API for a chat app, Http side is almost done, authentication too, I've just followed the documentation and it is working well, now I want to authenticate my user when they are trying to connect to my chat Gateway, I have tried @AuthGuard('jwt') but it seems not working, it there a way to properly do that please, thanks for your great work.

[Insidexa]

I can tell you @loicgeek how to do this, but i can't give the code.

1. create websocket jwt strategy extending PassportStrategy(Strategy, 'websocketStrategyName') , use ExtractJwt.fromUrlQueryParameter('jwtTokenFieldName')
   Example client

const jwtTokenFieldName = 'jwt token without bearer';
      const socket = io('http://localhost:3000/namespace', { transports: ['websocket'], path: '/websocket-path', query: { jwtTokenFieldName } });

1. add method validate to strategy, need check user in database etc.
2. add websocket strategy to providers

3. create websocket jwt guard extending AuthGuard and pass strategy name ( websocketStrategyName )

4. implement method getRequest in websocket jwt guard and return handshake switchToWs().getClient().handshake.
   Because we getting jwt token from url query parameter by name websocketStrategyName
   But we need to get request before using strategy
   By default JWT strategy getting from headers Authentication

5. Override get request in https://github.com/nestjs/passport/blob/master/lib/auth.guard.ts#L52
   SocketIO.Socket ( context.switchToWs().getClient() ) have handshake
   In handshake we can get websocket request url
   fromUrlQueryParameter getting request url and parse websocketStrategyName

User automatically set into switchToWs().getClient().handshake.user analogue to HTTP request

1. Add @UseGuard(WsJWTGuard) to websocket gateway

2. Auth user in handleConnection from client first argument ( in nestjs last version Kamil created decorators for client and payload ) as client.handshake.query.jwtTokenFieldName
   use jwt.verify
   Or hide this implementation in websocket jwt guard.

If you have any question - notify me

[loicgeek]

@Insidexa thanks for your reply, I will try and let you know

[kamilmysliwiec]

Please, use our Discord channel (support) for such questions. We are using GitHub to track bugs, feature requests, and potential improvements.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.