WebSocket authentication in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a WebSocket connection is accepted without authentication?

Consider a FastAPI WebSocket endpoint that accepts connections without checking any authentication token. What is the likely behavior when a client connects?

FastAPI

from fastapi import FastAPI, WebSocket
app = FastAPI()

@app.websocket('/ws')
async def websocket_endpoint(websocket: WebSocket):
    await websocket.accept()
    await websocket.send_text('Connected')
    await websocket.close()

A The server rejects the connection with a 401 Unauthorized error.

B The server raises a runtime error due to missing authentication.

C The connection hangs indefinitely without response.

D The client connects successfully and receives the 'Connected' message.

💡 Hint

Think about what happens if no authentication check is done before accepting the connection.

If the server accepts the WebSocket connection without checking authentication, the client connects successfully and can receive messages. No error occurs because no authentication logic is implemented.

📝 Syntax

intermediate

Which code snippet correctly extracts a token from WebSocket headers in FastAPI?

Given a WebSocket connection, which code correctly retrieves the 'Authorization' header token from the connection headers?

FastAPI

async def websocket_endpoint(websocket: WebSocket):
    # Extract token here
    pass

A token = websocket.cookies.get('Authorization')

B token = websocket.query_params['Authorization']

C token = websocket.headers.get('Authorization')

D token = websocket.body['Authorization']

💡 Hint

Headers are accessed differently than query parameters or cookies.

WebSocket headers can be accessed via websocket.headers, which is a case-insensitive dictionary-like object. The 'Authorization' token is typically sent in headers.

❓ state_output

advanced

What is the output when a WebSocket connection is closed after failed authentication?

Consider this FastAPI WebSocket endpoint that checks a token and closes the connection if invalid. What does the client receive?

FastAPI

from fastapi import FastAPI, WebSocket, WebSocketDisconnect
app = FastAPI()

@app.websocket('/ws')
async def websocket_endpoint(websocket: WebSocket):
    token = websocket.headers.get('Authorization')
    if token != 'validtoken':
        await websocket.close(code=1008)
        return
    await websocket.accept()
    await websocket.send_text('Welcome!')

A The client connection closes immediately with close code 1008 and no message.

B The client receives 'Welcome!' message before connection closes.

C The server raises a WebSocketDisconnect exception.

D The client connection stays open but receives no messages.

💡 Hint

What happens if await websocket.close() is called before accept()?

Calling await websocket.close() before accepting closes the connection immediately. The client gets a close frame with code 1008 (policy violation) and no messages.

🔧 Debug

advanced

Why does this FastAPI WebSocket authentication code raise a RuntimeError?

Examine the code below. It raises RuntimeError: Cannot send data before WebSocket is accepted. What is the cause?

FastAPI

from fastapi import FastAPI, WebSocket
app = FastAPI()

@app.websocket('/ws')
async def websocket_endpoint(websocket: WebSocket):
    token = websocket.headers.get('Authorization')
    if token == 'validtoken':
        await websocket.send_text('Welcome!')
    else:
        await websocket.close()

A The WebSocket connection was not accepted before sending messages.

B The token variable is None causing a TypeError.

C The headers attribute is not accessible in WebSocket.

D The close() method is called without a close code.

💡 Hint

Check the order of accept() and send_text() calls.

FastAPI requires calling await websocket.accept() before sending or receiving data. Sending data before accepting causes a RuntimeError.

🧠 Conceptual

expert

Which approach best secures WebSocket authentication in FastAPI for real-time apps?

For a FastAPI app using WebSockets, which approach provides the most secure and scalable authentication method?

A Authenticate users via cookies only and accept all WebSocket connections without checks.

B Send a JWT token in the WebSocket headers and verify it on connection before accepting.

C Accept all WebSocket connections and send authentication requests as messages after connection.

D Use IP address filtering to allow only trusted clients to connect.

💡 Hint

Consider security, scalability, and standard practices for real-time authentication.

Sending a JWT token in headers and verifying it before accepting the connection ensures only authorized clients connect. This is secure and scalable for real-time apps.