title: Websocket authentication ticket encryption
body: <p>I'm working on a simple web app that uses JWT authentication. Only authenticated users may open a Websocket with the server, and as it turns out, this is more complicated than setting an Authentication header (<a href="https://stackoverflow.com/questions/4361173/http-headers-in-websockets-client-api">HTTP headers in Websockets client API</a>).</p>
  
  <p>I'm following this article <a href="https://devcenter.heroku.com/articles/websocket-security#authentication-authorization" rel="nofollow noreferrer">https://devcenter.heroku.com/articles/websocket-security#authentication-authorization</a> to work around this. The above article describes generating a ticket for an authenticated client upon request (the ticket contains user id + IP address), storing the ticket (which expires after X seconds), and then having the client open a Websocket with the ticket as part of the URL. (e.g. "ws://localhost:3000/conn/[myticket]" or "ws://localhost:3000/conn?ticket=[myticket]").</p>
  
  <p>Here's my question: should this ticket be encrypted? If the ticket wasn't encrypted, could somebody spoof an IP address and then forge a valid ticket from that address, knowing that the ticket is unexpired and unused?</p>
  
  <p>Follow-up question: how should this ticket be encrypted? It has to be sent as part of a URL, so is binary encryption possible, or does it have to be UTF-8?</p>