{"action":"opened","issue":{"url":"https://api.github.com/repos/django/channels/issues/1012","repository_url":"https://api.github.com/repos/django/channels","labels_url":"https://api.github.com/repos/django/channels/issues/1012/labels{/name}","comments_url":"https://api.github.com/repos/django/channels/issues/1012/comments","events_url":"https://api.github.com/repos/django/channels/issues/1012/events","html_url":"https://github.com/django/channels/issues/1012","id":313152369,"number":1012,"title":"check java websocket authentication after login to the application and before @OnOpen connection","user":{"login":"AratRana","id":17128434,"avatar_url":"https://avatars0.githubusercontent.com/u/17128434?v=4","gravatar_id":"","url":"https://api.github.com/users/AratRana","html_url":"https://github.com/AratRana","followers_url":"https://api.github.com/users/AratRana/followers","following_url":"https://api.github.com/users/AratRana/following{/other_user}","gists_url":"https://api.github.com/users/AratRana/gists{/gist_id}","starred_url":"https://api.github.com/users/AratRana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AratRana/subscriptions","organizations_url":"https://api.github.com/users/AratRana/orgs","repos_url":"https://api.github.com/users/AratRana/repos","events_url":"https://api.github.com/users/AratRana/events{/privacy}","received_events_url":"https://api.github.com/users/AratRana/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-11T02:32:06Z","updated_at":"2018-04-11T02:32:06Z","closed_at":null,"author_association":"NONE","body":"I am implementing avax.websocket to update the count for message as below in my application.\r\n\r\nI want to secure the websocket endpoint and I used the below in web.xml and weblogic.xml but it did not work.\r\nAfter that I tried to use custom ServerEndpointConfig.Configurator, now I am able to connect after logged to my application. But the session is coming as null in request.\r\n\r\nWith authentication in web.xml\r\n\r\n    <?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n    <web-app xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns=\"http://xmlns.jcp.org/xml/ns/javaee\" \r\n    \txsi:schemaLocation=\"http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd\" \r\n    \tid=\"WebApp_ID\" version=\"3.1\">\r\n      <display-name>WebSocketPrj</display-name>\r\n      <security-constraint>\r\n      \t<web-resource-collection>\r\n      \t\t<web-resource-name>simple web resources</web-resource-name>\r\n      \t\t<url-pattern>/*</url-pattern>\r\n      \t</web-resource-collection>\r\n      \t<auth-constraint>\r\n      \t\t<role-name>TestUser</role-name>\r\n      \t</auth-constraint>\r\n      </security-constraint>\r\n      <login-config>\r\n      \t<auth-method>Basic</auth-method>\r\n      \t<realm-name>file</realm-name>\r\n      </login-config>\r\n      <security-role>\r\n      \t<role-name>TestUser</role-name>\r\n      </security-role> \r\n    </web-app>\r\n\r\n**weblogc.xml**\r\n\r\n    <?xml version='1.0' encoding='UTF-8'?>\r\n    <weblogic-web-app xmlns=\"http://xmlns.oracle.com/weblogic/weblogic-web-app\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:schemaLocation=\"http://xmlns.oracle.com/weblogic/weblogic-web-app http://xmlns.oracle.com/weblogic/weblogic-web-app/1.0/weblogic-web-app.xsd\">\r\n      <security-role-assignment>\r\n        <role-name>TestUser</role-name>\r\n        <principal-name>TestUser</principal-name>\r\n      </security-role-assignment>\r\n      <container-descriptor></container-descriptor>\r\n    </weblogic-web-app>\r\n\r\nwithout security-constraint in web.xml and without weblogic.xml\r\n\r\n    public class WebSocketConfigurator extends ServerEndpointConfig.Configurator{\r\n    private static final String ORIGIN = \"http://localhost:7001\";\r\n\r\n    @Override\r\n    public boolean checkOrigin(String originHeaderValue) {\r\n        return ORIGIN.equals(originHeaderValue);\r\n    }\r\n\r\n    @Override\r\n    public void modifyHandshake(ServerEndpointConfig config, HandshakeRequest request, HandshakeResponse response) {\r\n        HttpSession httpSession = (HttpSession) request.getHttpSession();\r\n        super.modifyHandshake(config, request, response);\r\n        if (httpSession == null) {\r\n            httpSession = (HttpSession) request.getHttpSession();\r\n        }\r\n\r\n        if (httpSession == null) {\r\n            return;\r\n        }\r\n\r\n        config.getUserProperties().put(\"httpSession\", httpSession);\r\n\r\n        httpSession = (HttpSession) request.getHttpSession();\r\n    }\r\n}\r\n\r\n\r\n@ServerEndpoint(value = \"/messageCount\", configurator = WebSocketConfigurator.class)\r\npublic class NotificationSocket {\r\n    private static final Logger logger = LoggerFactory.getLogger(NotificationSocket.class);\r\n\r\n    private Session wsSession;\r\n    private HttpSession httpSession;\r\n\r\n    /**\r\n     *\r\n     * @param session\r\n     */\r\n    @OnOpen\r\n    public void onOpen(Session session, EndpointConfig config){\r\n        \r\n    }\r\n\r\n    /**\r\n     *\r\n     */\r\n    @OnClose\r\n    public void onClose(){\r\n        // implementation not needed\r\n    }\r\n\r\n    /**\r\n     *\r\n     * @param session\r\n     * @param throwable\r\n     */\r\n    @OnError\r\n    public void error(Session session,Throwable throwable){\r\n        // implementation not needed\r\n    }\r\n\r\n    /**\r\n     *\r\n     * @param user\r\n     * @param session\r\n     */\r\n    @OnMessage\r\n    public void handleMessage(final String user, final Session session) {\r\n        synchronized (session) {\r\n            int count = 10;\r\n            \r\n            session.getAsyncRemote().sendText(\"\" + count);\r\n            \r\n        }\r\n    }\r\n}\r\n\r\nI have login page and after login in welcomauth.jsp I am calling the below websocket:\r\nand below is my javascript client:\r\n\r\n    var webSocket = new WebSocket(\"ws://localhost:7001/messageCount\");\r\n        webSocket.onopen=function(){\r\n        webSocket.send('Message');\r\n        }\r\n\r\nI don't want to pass the user information from client side in modifyhandshake I want to get the logged in user session then validate if the user exist then open the connection else throw exception.(like throw new RuntimeException(\"Not authenticated\"))\r\n\r\n**I am calling websocket after login to the application**. Is there any way to check authentication before the websocket connection(i.e @OnOpen)?\r\n\r\n"}}
{"actor":{"display_login":"AratRana"}}