Authentication in WebSocket connections in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main challenge of authenticating WebSocket connections compared to HTTP?

WebSocket connections start with an HTTP handshake but then switch to a persistent, full-duplex connection. This means you can't use standard HTTP authentication methods after the handshake, so authentication must happen during or before the handshake.

beginner

How can you pass authentication data when establishing a WebSocket connection?

You can send authentication data as query parameters in the WebSocket URL or include a token in the HTTP headers during the handshake phase.

intermediate

Why is it important to verify the token or credentials during the WebSocket handshake in Express?

Verifying credentials during the handshake ensures only authorized users can establish a WebSocket connection, preventing unauthorized access to the real-time communication channel.

intermediate

What Express middleware or library can help manage authentication tokens for WebSocket connections?

Libraries like 'jsonwebtoken' can verify JWT tokens, and middleware like 'express-session' can help manage sessions. These can be integrated during the WebSocket handshake to authenticate users.

intermediate

What is a common pattern to handle authentication errors in WebSocket connections?

If authentication fails during the handshake, the server should reject the connection immediately, often by closing the socket with an error code and message.

When is the best time to authenticate a WebSocket connection in Express?

A After the WebSocket connection is fully established

B Authentication is not needed for WebSocket

C After sending the first message

D During the initial HTTP handshake before upgrading

Authentication should happen during the HTTP handshake before the connection upgrades to WebSocket to prevent unauthorized connections.

Which method is NOT commonly used to send authentication data in WebSocket connections?

A Query parameters in the WebSocket URL

B HTTP headers during handshake

C Cookies after connection established

D Sending credentials in the first WebSocket message

Cookies cannot be sent after the WebSocket connection is established because it switches to the WebSocket protocol, which does not support HTTP cookies.

What library is commonly used in Express to verify JWT tokens for WebSocket authentication?

A jsonwebtoken

B express-session

C cors

D body-parser

'jsonwebtoken' is used to verify JWT tokens, which are often used for authenticating WebSocket connections.

What should the server do if authentication fails during the WebSocket handshake?

A Close the connection immediately with an error

B Allow connection but restrict messages

C Ignore and continue connection

D Send a warning message but keep connection open

The server should reject unauthorized connections immediately by closing the socket to maintain security.

Why can't you use standard HTTP authentication methods after the WebSocket connection is established?

A Because WebSocket connections do not support any authentication

B Because WebSocket is a different protocol after handshake

C Because HTTP authentication is insecure

D Because browsers block authentication headers

After the handshake, WebSocket uses a different protocol that does not support HTTP headers or methods, so authentication must be done during handshake.

Explain how you would implement authentication in an Express WebSocket server.

Think about the handshake phase and token verification.

Describe why authenticating WebSocket connections is different from HTTP requests.

Focus on protocol differences and timing.