title: How can I authenticate a websocket connection where client and server reside on seperate domains?
body: <p>I'm currently playing around with SignalR and websockets. From my research, it seems, as websockets do not support custom headers, there's basically only two ways to authenticate a websocket connection during token based authentication.</p>
  
  <p>1) Passing the token in the query string
  2) Storing the token in a cookie which then gets passed to the server when WithCredentials is set to true</p>
  
  <p>The first method isn't great practice - even through websocket communication is encrypted, query strings may be logged by servers etc.</p>
  
  <p>The second method I have got working on my local machine but it doesn't work once deployed because my client and server reside on different domains. So basically, I have an Angular site that has one domain (eg. client.com) and a WebAPI site that alls CORS with a completely different domain (eg. server.com). On my browser, if I'm on client.com, I cannot set a cookie that gets sent to server.com on a request.</p>
  
  <p>What is a good way to authenticate websockets when client and server sit on different domains?</p>