title: Make a java client to connect to spring boot websocket with spring security
body: <p>I am trying to make a java websocket. Project is having Spring Security enabled. When I am trying to connect to websocket, I am getting following error</p>
  
  <blockquote>
    <p>The HTTP response from the server [200] did not permit the HTTP upgrade to WebSocket</p>
  </blockquote>
  
  <p>Pom.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"&gt;
  &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
  &lt;groupId&gt;iot&lt;/groupId&gt;
  &lt;artifactId&gt;websocket&lt;/artifactId&gt;
  &lt;version&gt;0.1.0&lt;/version&gt;
  &lt;packaging&gt;war&lt;/packaging&gt;
  &lt;parent&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
      &lt;version&gt;1.5.7.RELEASE&lt;/version&gt;
  &lt;/parent&gt;
  &lt;properties&gt;
      &lt;java.version&gt;1.8&lt;/java.version&gt;
  &lt;/properties&gt;
  &lt;dependencies&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-websocket&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-messaging&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.microsoft.azure.sdk.iot&lt;/groupId&gt;
          &lt;artifactId&gt;iot-device-client&lt;/artifactId&gt;
          &lt;version&gt;1.3.32&lt;/version&gt;
      &lt;/dependency&gt;
  
      &lt;dependency&gt;
          &lt;groupId&gt;org.rxtx&lt;/groupId&gt;
          &lt;artifactId&gt;rxtx&lt;/artifactId&gt;
          &lt;version&gt;2.1.7&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-tx&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-orm&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;!-- Joda-Time --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;joda-time&lt;/groupId&gt;
          &lt;artifactId&gt;joda-time&lt;/artifactId&gt;
      &lt;/dependency&gt;
  
      &lt;!-- To map JodaTime with database type --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.jadira.usertype&lt;/groupId&gt;
          &lt;artifactId&gt;usertype.core&lt;/artifactId&gt;
          &lt;version&gt;3.0.0.CR1&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.apache.tomcat.embed&lt;/groupId&gt;
          &lt;artifactId&gt;tomcat-embed-jasper&lt;/artifactId&gt;
          &lt;scope&gt;provided&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
          &lt;artifactId&gt;jstl&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.json&lt;/groupId&gt;
          &lt;artifactId&gt;json&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-websocket&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.googlecode.json-simple&lt;/groupId&gt;
          &lt;artifactId&gt;json-simple&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.neovisionaries&lt;/groupId&gt;
          &lt;artifactId&gt;nv-websocket-client&lt;/artifactId&gt;
          &lt;version&gt;2.3&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;commons-pool&lt;/groupId&gt;
          &lt;artifactId&gt;commons-pool&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.apache.httpcomponents&lt;/groupId&gt;
          &lt;artifactId&gt;httpclient&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;!-- Added Last --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-beans&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-context&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.slf4j&lt;/groupId&gt;
          &lt;artifactId&gt;slf4j-api&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.apache.commons&lt;/groupId&gt;
          &lt;artifactId&gt;commons-lang3&lt;/artifactId&gt;
          &lt;version&gt;3.0&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;commons-httpclient&lt;/groupId&gt;
          &lt;artifactId&gt;commons-httpclient&lt;/artifactId&gt;
          &lt;version&gt;3.1&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-core&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-web&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.hibernate&lt;/groupId&gt;
          &lt;artifactId&gt;hibernate-core&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;javax.validation&lt;/groupId&gt;
          &lt;artifactId&gt;validation-api&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.hibernate&lt;/groupId&gt;
          &lt;artifactId&gt;hibernate-validator&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
          &lt;artifactId&gt;javax.servlet-api&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;javax.servlet.jsp&lt;/groupId&gt;
          &lt;artifactId&gt;javax.servlet.jsp-api&lt;/artifactId&gt;
          &lt;version&gt;2.3.1&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-tomcat&lt;/artifactId&gt;
          &lt;scope&gt;provided&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.data&lt;/groupId&gt;
          &lt;artifactId&gt;spring-data-commons&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;!-- Azure --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.microsoft.azure.sdk.iot&lt;/groupId&gt;
          &lt;artifactId&gt;iot-service-client&lt;/artifactId&gt;
          &lt;version&gt;1.7.23&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.microsoft.azure.sdk.iot&lt;/groupId&gt;
          &lt;artifactId&gt;iot-device-client&lt;/artifactId&gt;
          &lt;version&gt;1.3.32&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.google.code.gson&lt;/groupId&gt;
          &lt;artifactId&gt;gson&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.microsoft.azure&lt;/groupId&gt;
          &lt;artifactId&gt;azure-servicebus&lt;/artifactId&gt;
          &lt;version&gt;0.9.7&lt;/version&gt;
      &lt;/dependency&gt;
  &lt;/dependencies&gt;
  
  &lt;build&gt;
      &lt;plugins&gt;
          &lt;plugin&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt;
          &lt;/plugin&gt;
      &lt;/plugins&gt;
  &lt;/build&gt;
  
  &lt;repositories&gt;
      &lt;repository&gt;
          &lt;id&gt;spring-releases&lt;/id&gt;
          &lt;name&gt;Spring Releases&lt;/name&gt;
          &lt;url&gt;https://repo.spring.io/libs-release&lt;/url&gt;
      &lt;/repository&gt;
  &lt;/repositories&gt;
  &lt;pluginRepositories&gt;
      &lt;pluginRepository&gt;
          &lt;id&gt;spring-releases&lt;/id&gt;
          &lt;name&gt;Spring Releases&lt;/name&gt;
          &lt;url&gt;https://repo.spring.io/libs-release&lt;/url&gt;
      &lt;/pluginRepository&gt;
  &lt;/pluginRepositories&gt;
  </code></pre>
  
  <p></p>
  
  <p>Websocket Security Configuration</p>
  
  <pre><code>import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.web.messaging.MessageSecurityMetadataSourceRegistry;
  import org.springframework.security.config.annotation.web.socket.AbstractSecurityWebSocketMessageBrokerConfigurer;
  
  @Configuration
  public class WebSocketSecurityConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer {
  
  @Override
  protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
      messages
              .nullDestMatcher().authenticated()
              .simpSubscribeDestMatchers("/datasocket","/ehmdatasocket").permitAll()
              .anyMessage().permitAll(); 
  }
  @Override
  protected boolean sameOriginDisabled() {
      return true;
  }
  }
  </code></pre>
  
  <p>Websocket Server Configuration</p>
  
  <pre><code>import java.util.Map;
  
  import javax.servlet.http.HttpServletRequest;
  
  import org.springframework.context.annotation.ComponentScan;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.http.server.ServerHttpRequest;
  import org.springframework.http.server.ServerHttpResponse;
  import org.springframework.http.server.ServletServerHttpRequest;
  import org.springframework.web.servlet.HandlerMapping;
  import org.springframework.web.socket.WebSocketHandler;
  import org.springframework.web.socket.config.annotation.EnableWebSocket;
  import org.springframework.web.socket.config.annotation.WebSocketConfigurer;
  import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;
  import org.springframework.web.socket.server.HandshakeInterceptor;
  
  import com.ey.iotsphereeg.websocket.ServerWebSocketHandler;
  
  @Configuration
  @EnableWebSocket
  public class WebSocketConfig implements WebSocketConfigurer {
  
  
      public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
          registry.addHandler(new ServerWebSocketHandler(), "/datasocket");
  
      }
  }
  </code></pre>
  
  <p>Websocket server handler</p>
  
  <pre><code>import org.json.simple.JSONObject;
  import org.json.simple.parser.JSONParser;
  import org.json.simple.parser.ParseException;
  import org.springframework.stereotype.Component;
  import org.springframework.web.socket.CloseStatus;
  import org.springframework.web.socket.TextMessage;
  import org.springframework.web.socket.WebSocketSession;
  import org.springframework.web.socket.handler.TextWebSocketHandler;
  import java.io.IOException;
  import java.util.ArrayList;
  import java.util.List;
  import java.util.concurrent.CopyOnWriteArrayList;
  
  @Component
  public class ServerWebSocketHandler extends TextWebSocketHandler {
      public List&lt;WebSocketSession&gt; sessions = new CopyOnWriteArrayList&lt;&gt;();
  
      @Override
      public void handleTextMessage(WebSocketSession session, TextMessage message)
              throws InterruptedException, IOException {
          //System.out.println(message.getPayload());
          JSONParser parser = new JSONParser();
          Object obj = null;
          try {
              obj = parser.parse(message.getPayload());
          } catch (ParseException e1) {
              e1.printStackTrace();
          }
          JSONObject jsonObject = (JSONObject) obj;
          //int size = sessions.size();
          if (!jsonObject.containsKey("test"))
              sendAll(message);
      }
  
      @Override
      public void afterConnectionEstablished(WebSocketSession session) throws Exception {
          // the messages will be broadcasted to all users.
          System.out.println(session.toString());
          //test.session = session;
          sessions.add(session);
          int s = sessions.size();
          System.out.println(s);
      }
  
      @Override
      public void afterConnectionClosed(WebSocketSession session, CloseStatus status) throws Exception {
          // the messages will be broadcasted to all users.
          sessions.remove(session);
      }
  
      @Override
      public void handleTransportError(WebSocketSession session, Throwable exception)throws Exception {
          // the messages will be broadcasted to all users.
          sessions.remove(session);
      }
  
      public void sendAll(TextMessage message) {
          try {
              int size = sessions.size();
              System.out.println(size);
              ArrayList&lt;WebSocketSession&gt; closedSessions = new ArrayList&lt;&gt;();
              for (WebSocketSession session : sessions) {
                  if (!session.isOpen()) {
                      System.err.println("Closed session: " + session.getId());
                      closedSessions.add(session);
                  } else {
                      System.out.println(message.getPayload());
                      session.sendMessage(message);
                  }
              }
              sessions.removeAll(closedSessions);
          } catch (Throwable e) {
              e.printStackTrace();
          }
      }
  }
  </code></pre>
  
  <p>Websocket Client</p>
  
  <pre><code>import javax.websocket.ClientEndpoint;
  import javax.websocket.OnError;
  import javax.websocket.OnMessage;
  import javax.websocket.OnOpen;
  import javax.websocket.Session;
  
  @ClientEndpoint
  public class MyClient {
      @OnOpen
      public void onOpen(Session session) {
          System.out.println("##### Websocket Client Connected to endpoint: " + session.getAsyncRemote());
  
      }
  
      @OnMessage
      public void onMessage(String message) {
        //  System.out.println(message);
      }
  
      @OnError
      public void onError(Throwable t) {
          t.printStackTrace();
      }
  }
  </code></pre>
  
  <p>Now when I am trying to connect without Spring Security enabled, It is working but when Spring boot Security is enable, I am not able to make handshake.</p>
  
  <p>I tried reading documentations and tried to search on internet for long, but I didn't get proper solutions.</p>