<p>I'm trying to exec kubernetes pod using the Websocket, as per the kubernetes document it can be achieved through passing the  <strong>Bearer THETOKEN</strong></p>

<p>When using bearer token authentication from an http client, the API server expects an Authorization header with a value of Bearer THETOKEN</p>

<p>Here is the sample for <code>wscat</code> passing Header Value <code>--header "Authorization: Bearer $TOKEN"</code> to establish exec to pod and the connection  went successfully</p>

<pre><code>/ # wscat  --header "Authorization: Bearer $TOKEN"  -c "wss://api.0cloud0.com/api/v1/namespaces/ba410a7474380169a5ae230d8e784535/pods/txaclqhshg
-6f69577c74-jxbwn/exec?stdin=1&amp;stdout=1&amp;stderr=1&amp;tty=1&amp;command=sh"
</code></pre>

<p>But when it comes to <a href="https://developer.mozilla.org/en/docs/Web/API/WebSocket" rel="noreferrer">Websocket API</a> connection from web browser </p>

<blockquote>
  <p>How to pass this Beaer Token in the web Socket as per the doc there is no standard way to pass custom header </p>
</blockquote>

<p>Tried URI Query Parameter <strong>access_token= Bearer TOKEN</strong> in the API query it doesn't work and the Authentication denied with 403 </p>

<pre><code>wss://api.0cloud0.com/api/v1/namespaces/ba410a7474380169a5ae230d8e784535/pods/txaclqhshg-%206f69577c74-jxbwn/exec?stdout=1&amp;stdin=1&amp;stderr=1&amp;tty=1&amp;command=%2Fbin%2Fsh&amp;command=-i&amp;access_token=$TOKEN
</code></pre>

<p>I never used websocket with kubernetes before, but here is the documentation about the token authentication method for websocket browser clients <a href="https://github.com/kubernetes/kubernetes/pull/47740" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/pull/47740</a></p>
<p>You must to send token in subprotocol parameter with the token encoded in base64.</p>
<p>So it should be:</p>
<pre><code>wscat  -s &quot;base64url.bearer.authorization.k8s.io.$TOKEN_IN_BASE64&quot;,&quot;base64.binary.k8s.io&quot; -c &quot;wss://api.0cloud0.com/api/v1/namespaces/ba410a7474380169a5ae230d8e784535/pods/txaclqhshg
-6f69577c74-jxbwn/exec?stdin=1&amp;stdout=1&amp;stderr=1&amp;tty=1&amp;command=sh&quot;
</code></pre>
