title: Is it possible to secure WebSocket APIs with OAuth 2.0?
body: <p>I am implementing an OAuth Provider to secure different web-based APIs. The most headache is giving me the securing of WebSockets through OAuth. </p>
  
  <p>Can it be done completely secure in a client that's set in a Browser?</p>
  
  <p>What are the risks if it is in a Browser compared to a web application with a Server?</p>
  
  <p>I want to use 2-legged OAuth to restrict the connections to the websocket, so only registered clients can acquire a WebSocket connection to the API without being refused. Since a WebSocket connection is always (!) established on the client-side (from the Browser), is it possible to protect the accessToken from being stolen and misused? <br/>
  At that point, the only thing that sets a browser-based client from a web-application client appart is the URL. </p>
  
  <p>If browser-based applications are unsafe, I could live with that, but I want to make sure that at least the web-based applications have a secure way to access the websocket.</p>
  
  <p>But at that point I ask myself if the accessToken is needed at all, because than I could just use the origin-URI as only secure mechanism.</p>