WebSocket authentication in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a WebSocket connection is accepted without authentication?

Consider a FastAPI WebSocket endpoint that accepts connections without checking any authentication token. What is the likely behavior when a client connects?

FastAPI

from fastapi import FastAPI, WebSocket
app = FastAPI()

@app.websocket('/ws')
async def websocket_endpoint(websocket: WebSocket):
    await websocket.accept()
    await websocket.send_text('Connected')
    await websocket.close()

A The server rejects the connection with a 401 Unauthorized error.

B The server raises a runtime error due to missing authentication.

C The connection hangs indefinitely without response.

D The client connects successfully and receives the 'Connected' message.

💡 Hint

Think about what happens if no authentication check is done before accepting the connection.

If the server accepts the WebSocket connection without checking authentication, the client connects successfully and can receive messages. No error occurs because no authentication logic is implemented.

📝 Syntax

intermediate

Which code snippet correctly extracts a token from WebSocket headers in FastAPI?

Given a WebSocket connection, which code correctly retrieves the 'Authorization' header token from the connection headers?

FastAPI

async def websocket_endpoint(websocket: WebSocket):
    # Extract token here
    pass

A token = websocket.cookies.get('Authorization')

B token = websocket.query_params['Authorization']

C token = websocket.headers.get('Authorization')

D token = websocket.body['Authorization']

💡 Hint

Headers are accessed differently than query parameters or cookies.

WebSocket headers can be accessed via websocket.headers, which is a case-insensitive dictionary-like object. The 'Authorization' token is typically sent in headers.

❓ state_output

advanced

What is the output when a WebSocket connection is closed after failed authentication?

Consider this FastAPI WebSocket endpoint that checks a token and closes the connection if invalid. What does the client receive?

FastAPI

from fastapi import FastAPI, WebSocket, WebSocketDisconnect
app = FastAPI()

@app.websocket('/ws')
async def websocket_endpoint(websocket: WebSocket):
    token = websocket.headers.get('Authorization')
    if token != 'validtoken':
        await websocket.close(code=1008)
        return
    await websocket.accept()
    await websocket.send_text('Welcome!')

A The client connection closes immediately with close code 1008 and no message.

B The client receives 'Welcome!' message before connection closes.

C The server raises a WebSocketDisconnect exception.

D The client connection stays open but receives no messages.

💡 Hint

What happens if await websocket.close() is called before accept()?

Calling await websocket.close() before accepting closes the connection immediately. The client gets a close frame with code 1008 (policy violation) and no messages.

🔧 Debug

advanced

Why does this FastAPI WebSocket authentication code raise a RuntimeError?

Examine the code below. It raises RuntimeError: Cannot send data before WebSocket is accepted. What is the cause?

FastAPI

from fastapi import FastAPI, WebSocket
app = FastAPI()

@app.websocket('/ws')
async def websocket_endpoint(websocket: WebSocket):
    token = websocket.headers.get('Authorization')
    if token == 'validtoken':
        await websocket.send_text('Welcome!')
    else:
        await websocket.close()

A The WebSocket connection was not accepted before sending messages.

B The token variable is None causing a TypeError.

C The headers attribute is not accessible in WebSocket.

D The close() method is called without a close code.

💡 Hint

Check the order of accept() and send_text() calls.

FastAPI requires calling await websocket.accept() before sending or receiving data. Sending data before accepting causes a RuntimeError.

🧠 Conceptual

expert

Which approach best secures WebSocket authentication in FastAPI for real-time apps?

For a FastAPI app using WebSockets, which approach provides the most secure and scalable authentication method?

A Authenticate users via cookies only and accept all WebSocket connections without checks.

B Send a JWT token in the WebSocket headers and verify it on connection before accepting.

C Accept all WebSocket connections and send authentication requests as messages after connection.

D Use IP address filtering to allow only trusted clients to connect.

💡 Hint

Consider security, scalability, and standard practices for real-time authentication.

Sending a JWT token in headers and verifying it before accepting the connection ensures only authorized clients connect. This is secure and scalable for real-time apps.

Practice

1. What is the main purpose of WebSocket authentication in FastAPI?

easy

A. To speed up the WebSocket connection process

B. To confirm the user's identity before allowing the WebSocket connection

C. To encrypt the WebSocket messages automatically

D. To log all WebSocket messages for debugging

Solution

1. Step 1: Understand WebSocket authentication role

   Authentication ensures only authorized users can connect to the WebSocket.

2. Step 2: Identify the main goal in FastAPI context

   FastAPI uses authentication to confirm user identity before opening the connection.

3. Final Answer:

   To confirm the user's identity before allowing the WebSocket connection -> Option B

4. Quick Check:

   Authentication = Confirm identity [OK]

Hint: Authentication means confirming user identity before connection [OK]

Common Mistakes:

• Confusing authentication with encryption
• Thinking authentication speeds up connection
• Assuming authentication logs messages

2. Which of the following is the correct way to accept a WebSocket connection with token authentication in FastAPI?

easy

A. await websocket.accept() without checking token

B. Call await websocket.close() before checking token

C. Use await websocket.send_text() before accepting

D. Check token, then call await websocket.accept() if valid

Solution

1. Step 1: Understand WebSocket connection flow

   You must check the token first to decide if connection is allowed.

2. Step 2: Accept connection only if token is valid

   Call await websocket.accept() only after confirming token validity.

3. Final Answer:

   Check token, then call await websocket.accept() if valid -> Option D

4. Quick Check:

   Accept after token check = C [OK]

Hint: Accept connection only after validating token [OK]

Common Mistakes:

• Accepting connection before token check
• Closing connection before checking token
• Sending messages before accepting connection

3. Given this FastAPI WebSocket code snippet, what will happen if the token is invalid?

async def websocket_endpoint(websocket: WebSocket):
    token = websocket.query_params.get('token')
    if token != 'secret123':
        await websocket.close(code=1008)
    else:
        await websocket.accept()
        await websocket.send_text('Welcome!')

medium

A. The connection closes immediately with code 1008

B. The connection accepts and sends 'Welcome!' anyway

C. The server raises a runtime error

D. The connection stays open but no message is sent

Solution

1. Step 1: Check token validation logic

   If token is not 'secret123', the code calls await websocket.close(code=1008).

2. Step 2: Understand WebSocket close behavior

   Calling close immediately ends the connection with the given code.

3. Final Answer:

   The connection closes immediately with code 1008 -> Option A

4. Quick Check:

   Invalid token triggers close(1008) [OK]

Hint: Invalid token triggers immediate close with code 1008 [OK]

Common Mistakes:

• Assuming connection accepts anyway
• Expecting a runtime error
• Thinking connection stays open silently

4. Identify the error in this FastAPI WebSocket authentication code:

async def websocket_endpoint(websocket: WebSocket):
    token = websocket.headers.get('Authorization')
    if token != 'Bearer secret123':
        await websocket.accept()
        await websocket.send_text('Unauthorized')
        await websocket.close()
    else:
        await websocket.accept()
        await websocket.send_text('Welcome')

medium

A. Using headers.get instead of query_params.get

B. Not closing connection on invalid token

C. Accepting connection before sending 'Unauthorized' message

D. Missing await before websocket.close()

Solution

1. Step 1: Analyze connection flow on invalid token

   The code calls await websocket.accept() before sending 'Unauthorized' and closing.

2. Step 2: Understand best practice for unauthorized access

   It is better to close connection immediately without accepting it to avoid opening unauthorized connection.

3. Final Answer:

   Accepting connection before sending 'Unauthorized' message -> Option C

4. Quick Check:

   Unauthorized should close without accept [OK]

Hint: Do not accept connection before rejecting unauthorized users [OK]

Common Mistakes:

• Accepting connection before rejecting
• Ignoring connection close on invalid token
• Confusing headers and query parameters

5. You want to authenticate WebSocket connections in FastAPI using a token passed as a query parameter. Which approach correctly handles authentication and rejects unauthorized users cleanly?

hard

A. Check token from query params; if invalid, call await websocket.close(1008) before accept; else accept connection

B. Accept connection first, then check token; if invalid, send 'Unauthorized' message and close

C. Ignore token and accept all connections; handle authorization in message handlers

D. Check token in headers only; ignore query parameters

Solution

1. Step 1: Understand token location and validation

   Token is passed as query parameter, so check websocket.query_params for token.

2. Step 2: Handle unauthorized users before accepting connection

   If token is invalid, close connection immediately with code 1008 to reject cleanly.

3. Step 3: Accept connection only if token is valid

   Only call await websocket.accept() after confirming token validity.

4. Final Answer:

   Check token from query params; if invalid, call await websocket.close(1008) before accept; else accept connection -> Option A

5. Quick Check:

   Reject before accept with close(1008) = A [OK]

Hint: Reject unauthorized before accept using close(1008) [OK]

Common Mistakes:

• Accepting connection before token check
• Ignoring query parameters for token
• Handling authorization after connection open