How do you implement WebSocket authentication and authorization?

Question

Accepted Answer

**WebSocket auth** — verify identity before allowing connections.

```javascript
const { WebSocketServer } = require("ws");
const jwt = require("jsonwebtoken");

const wss = new WebSocketServer({ port: 8080 });

wss.on("connection", (ws, req) => {
    // Authenticate on connection
    const token = new URL(req.url, "http://localhost")
        .searchParams.get("token");

if (!token) {
        ws.close(1008, "No token provided");
        return;
    }

try {
        const user = jwt.verify(token, process.env.JWT_SECRET);
        ws.user = user;
    } catch (err) {
        ws.close(1008, "Invalid token");
        return;
    }

ws.on("message", (data) => {
        const message = JSON.parse(data);

// Authorize each action
        if (message.type === "admin:delete" && ws.user.role !== "admin") {
            ws.send(JSON.stringify({ error: "Unauthorized" }));
            return;
        }

// Handle message
        handleMessage(ws, message);
    });
});
```

**Alternative — verify via HTTP first:**
```javascript
const server = app.listen(8080);
const wss = new WebSocketServer({ noServer: true });

server.on("upgrade", (req, socket, head) => {
    // Authenticate via session/cookie
    authenticate(req, (err, user) => {
        if (err || !user) {
            socket.destroy();
            return;
        }
        wss.handleUpgrade(req, socket, head, (ws) => {
            ws.user = user;
            wss.emit("connection", ws, req);
        });
    });
});
```

Node.js: How do you implement WebSocket authentication and authorization?