title: SpringMVC Websockets Messaging User Authentication with Spring Security
body: <p>I have seen a couple of threads about this issue, but none of them seem to really answer the question directly.</p>
  
  <p>Background, I have spring security installed, working, and running smoothly in other parts of the application.  My username is "developer".</p>
  
  <p>Running on Java 7, Glassfish 4, Spring 4, and using Angular + StompJS</p>
  
  <p>Let's get some code here:</p>
  
  <pre><code>package com.myapp.config;
  
  import org.springframework.context.annotation.Configuration;
  import org.springframework.messaging.simp.config.MessageBrokerRegistry;
  import org.springframework.web.socket.config.annotation.AbstractWebSocketMessageBrokerConfigurer;
  import org.springframework.web.socket.config.annotation.EnableWebSocketMessageBroker;
  import org.springframework.web.socket.config.annotation.StompEndpointRegistry;
  
  @Configuration
  @EnableWebSocketMessageBroker
  public class WebSocketBrokerConfig extends AbstractWebSocketMessageBrokerConfigurer {
  
      public final static String userDestinationPrefix = "/user/";
  
      @Override
      public void registerStompEndpoints(StompEndpointRegistry registry) {
          registry.addEndpoint("/stomp").withSockJS().setSessionCookieNeeded(true);
      }
  
      @Override
      public void configureMessageBroker(MessageBrokerRegistry registry) {
          registry.setApplicationDestinationPrefixes("/app");
          //registry.enableStompBrokerRelay("/topic,/user");
          registry.enableSimpleBroker("/topic", "/user");
          registry.setUserDestinationPrefix(userDestinationPrefix);
  
  
      }
  
  
  }
  </code></pre>
  
  <p>Ok, now here is a controller, to send out stuff every 3 seconds:</p>
  
  <pre><code>import org.springframework.messaging.simp.SimpMessagingTemplate;
  
  …
  
  @Autowired
  private SimpMessagingTemplate messagingTemplate;
  
  …
  
  @Scheduled(fixedDelay = 3000)
  public void sendStuff () 
  {
  
      Map&lt;String, Object&gt; map = new HashMap&lt;&gt;();
      map.put(MessageHeaders.CONTENT_TYPE, MimeTypeUtils.APPLICATION_JSON);
      System.out.print("Sending data! " + System.currentTimeMillis());
      //messagingTemplate.convertAndSend("/topic/notify", "Public: " + System.currentTimeMillis());
  
      messagingTemplate.convertAndSendToUser("developer", "/notify", "User: " + System.currentTimeMillis());
      messagingTemplate.convertAndSendToUser("notYou", "/notify", "Mr Developer Should Not See This: " + System.currentTimeMillis());
  }
  </code></pre>
  
  <p>And finally the JavaScript using SockJS</p>
  
  <pre><code>    var client = new SockJS('/stomp');
      var stomp = Stomp.over(client);
      stomp.connect({}, function(s) {
  
          //This should work
          stomp.subscribe('/user/' + s.headers['user-name'] + '/notify', console.debug);
  
          //This SHOULD NOT
          stomp.subscribe('/user/notYou/notify', console.debug);
  
      });
      client.onclose = $scope.reconnect;
  </code></pre>
  
  <p>And finally, for kicks, the pom.xml</p>
  
  <pre><code>    &lt;dependency&gt;
          &lt;groupId&gt;javax.websocket&lt;/groupId&gt;
          &lt;artifactId&gt;javax.websocket-api&lt;/artifactId&gt;
          &lt;version&gt;1.0&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-messaging&lt;/artifactId&gt;
          &lt;version&gt;4.0.6.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-websocket&lt;/artifactId&gt;
          &lt;version&gt;4.0.6.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
  </code></pre>
  
  <p>Here is what does work:</p>
  
  <ol>
  <li>I can produce wonderfully communication back and forth between the client and the server</li>
  <li>It's fast</li>
  <li><code>messagingTemplate.convertAndSend</code> and <code>messagingTemplate.convertAndSendToUser</code></li>
  </ol>
  
  <p>This is the problem (noted above): Anyone can subscribe to other users feeds.</p>
  
  <p>Now, there are a few other versions of this floating around, I will list them below, and explain why the answers are all wrong:</p>
  
  <p><a href="https://stackoverflow.com/questions/16266775/what-are-the-security-issues-around-an-open-websocket-connection">What are the security issues around an open websocket connection?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/23778451/spring-websocket-with-stomp-security-every-user-can-subscribe-to-any-other-use/24912974#comment38877147_24912974">Spring websocket with stomp security - every user can subscribe to any other users queue?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/24282138/websocket-how-to-push-a-message-to-a-target-user/24912748#comment38877178_24912748">Websocket: How To Push A Message To A Target User</a></p>
  
  <p>Here's the problem:</p>
  
  <ul>
  <li><p>Look at <code>messagingTemplate.convertAndSendToUser</code> - All that does is add the "user prefix" and then the username provided and then use <code>messagingTemplate.convertAndSend</code> which does not apply security.</p></li>
  <li><p>Then people say that "you need to use spring security just like everywhere else" - the problem here is A) that I am SENDING data to the client asynchronously, so B) I will be using this code completely outside of the user's session, possibly from a different user (say to send a notification to another logged in user).  </p></li>
  </ul>
  
  <p>Let me know if this is too closely related to a different post, but I this is a big problem for me and I wanted to do this justice.</p>
  
  <p>I can get more details though if anyone needs more details.</p>