WebSocket authentication in FastAPI - Step-by-Step Execution

Concept Flow - WebSocket authentication

Client connects WebSocket

↓

Server receives connection

↓

Server checks auth token

↓

Accept connection

↓

Start message handling

The server accepts a WebSocket connection, checks the client's authentication token, and either accepts or rejects the connection based on validity.

Execution Sample

FastAPI

from fastapi import FastAPI, WebSocket, WebSocketDisconnect
app = FastAPI()

@app.websocket('/ws')
async def websocket_endpoint(websocket: WebSocket):
    token = websocket.headers.get('Authorization')
    if token != 'valid-token':
        await websocket.close()
        return
    await websocket.accept()
    await websocket.send_text('Welcome!')

This code accepts a WebSocket connection only if the Authorization header matches 'valid-token'; otherwise, it closes the connection.

Execution Table

Step	Action	Auth Token	Condition	Result	Connection State	Message Sent
1	Client connects	Authorization header sent: 'valid-token'	token == 'valid-token'?	True	Connection accepted	None
2	Server accepts connection	valid-token	N/A	N/A	Connected	None
3	Server sends welcome message	valid-token	N/A	N/A	Connected	'Welcome!'
4	Client receives message	valid-token	N/A	N/A	Connected	'Welcome!'
5	Connection remains open	valid-token	N/A	N/A	Connected	None
6	Client disconnects	valid-token	N/A	N/A	Disconnected	None

💡 Connection closes only if token is invalid; here token is valid, so connection stays open.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
token	None	'valid-token'	'valid-token'	'valid-token'	'valid-token'
Connection State	Disconnected	Connecting	Connected	Connected	Disconnected
Message Sent	None	None	None	'Welcome!'	None

Key Moments - 2 Insights

Why does the server close the connection if the token is invalid?

Because the condition token == 'valid-token' fails (see execution_table step 1), the server calls websocket.close() to reject unauthorized clients.

When does the server send the welcome message?

Only after accepting the connection (execution_table step 2), the server sends the welcome message (step 3). Sending before accept would cause an error.

Visual Quiz - 3 Questions

Look at the execution_table at step 1. What is the value of the auth token?

A None

B 'valid-token'

C 'invalid-token'

D 'Authorization'

💡 Hint

Check the 'Auth Token' column at step 1 in the execution_table.

At which step does the server accept the WebSocket connection?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look at the 'Connection State' column in execution_table to see when it changes to 'Connected'.

If the token was invalid, what would happen at step 1?

A Connection closed immediately

B Connection accepted but no message sent

C Connection accepted and welcome message sent

D Server waits for client message

💡 Hint

Refer to the concept_flow where invalid token leads to connection rejection.

Concept Snapshot

WebSocket authentication in FastAPI:
- Client sends token in headers on connect
- Server checks token before accepting
- If valid, call websocket.accept() and proceed
- If invalid, call websocket.close() to reject
- Send messages only after accept
- Keep connection open for authorized clients

Full Transcript

This example shows how FastAPI handles WebSocket authentication. When a client connects, the server reads the Authorization header token. If the token matches the expected value, the server accepts the connection and sends a welcome message. If the token is invalid, the server closes the connection immediately. This ensures only authorized clients can keep the WebSocket open. The execution table traces each step: connection attempt, token check, accept or close, and message sending. Variables like token and connection state update accordingly. Key moments clarify why the server closes unauthorized connections and when messages can be sent. The visual quiz tests understanding of token values, connection acceptance timing, and behavior on invalid tokens.