如何在Play的2.0 WebSocket中验证用户身份？

Question

ellou'

I have common Play WebSocket method which is working as expected, but I need to authenticate user. Unfortunately when trying even simplest way to identify user in the method:

public class Application extends Controller {
    public static WebSocket<JsonNode> connect() {
        return new WebSocket<JsonNode>() {

            @Override
            public void onReady(final WebSocket.In<JsonNode> in, final WebSocket.Out<JsonNode> out) {
                User logged = User.findByUsername(Http.Context.current().request().username());
                // ...
            }
        };
    }
}

I get an error:

java.lang.RuntimeException: There is no HTTP Context available from here.

My current workaround is to pass random, unique identifier to view and saving it in User model, than I can connect to the socket from the view and find user with the given identifier, but this is no perfect as there can be only one WebSocket connection per user and also doesn't prevent the spoof.

How should I authenticate the user and prevent spoof attack?

Answer 1

I don't know where comes your piece of code, but you should be able to access the HTTP request on the initialization of the Websocket (first connection), ie you should be able to check for authentication only when you initiate the websocket socket connection (subsequent call will not be using HTTP, it is how Webscokets works).

So for instance, in your controller, you could have something like this:

public class Application extends Controller {

   public static WebSocket<JsonNode> connect() {

        Logger.info("Username from request = " + request().username());

        return new WebSocket<JsonNode>() {

            @Override
            public void onReady(final WebSocket.In<JsonNode> in, final WebSocket.Out<JsonNode> out) {
                // ....

            }

        };
    }

}

Answer 2

Have you tried retrieving the authenticated user ID from the HTTP Session instead? The context seems to be available at that point.

Answer 3

As data I want to send are sensitive and in this case security is more important to me than performance, finally I used two-step messages, first sending via WebSocket id of the message and some not important data and then fetching via AJAX and secured action message body after user's authentication.

Question remains opened: Of course if there will be other suggestions I will change my vote :)