Jetty Websocket Authentication

Question

I play the Jetty Websocket use example here :

https://github.com/jetty-project/embedded-jetty-websocket-examples (i use native-jetty-websocket-example)

I just move from websocketpp (C++) to Java Jetty Websocket and i just wonder is there any way for me to authen the connection before the connection move to the onWebSocketConnect event ?

Back in websocketpp i'll authenticate the connection via url (eg: ws://xxx/?key=123) when i will accept the connection or not. I can drop the connection before it "upgrade", and the client will result in connect failed

In Java i don't known how to do that, when the event come to onWebSocketConnect then the connection is etablished

Answer 1

You can set up Security Constraints for that path and configure the Jetty authentication mechanisms, see details of how to do that here https://www.eclipse.org/jetty/documentation/jetty-9/index.html#configuring-security.

You could also use the JettyWebSocketCreator to do some checks on the HTTP Request just before the connection upgrades to WebSocket. Instead of this line https://github.com/jetty-project/embedded-jetty-websocket-examples/blob/564c40b56413905cadeb500ade40d53e578ea990/native-jetty-websocket-example/src/main/java/org/eclipse/jetty/demo/EventServer.java#L55

You can do something like:

wsContainer.addMapping("/events/*", (req, resp) ->
{
    if (!Objects.equals(req.getParameterMap().get("key"), "123"))
    {
        resp.sendError(...);
        return null;
    }

    return new EventSocket();
});