feat(api-server): add websocket authorization #3854

Open

cxntered wants to merge 2 commits from cxntered/feat/ws-authorization into master

cxntered commented

2025-09-09 12:38:10 +00:00

(Migrated from github.com)

adds authorization for websocket connections with bearer tokens (retrieved from the /auth/:id endpoint) using the ?token query param.
if a client is unauthorized, it closes the connection with status code 1008 (policy violation) with the message "Unauthorized".
not sure if this was the best way to implement authorization, but i am open to suggestions :>

adds authorization for websocket connections with bearer tokens (retrieved from the `/auth/:id` endpoint) using the `?token` query param. if a client is unauthorized, it closes the connection with status code `1008` (policy violation) with the message "Unauthorized". not sure if this was the best way to implement authorization, but i am open to suggestions :>

cxntered commented

2025-09-09 12:41:40 +00:00

(Migrated from github.com)

if security is a concern (we are passing in the token directly in the url after all), passing in the token through the Sec-WebSocket-Protocol header could be an alternative, but i don't know if that's a major concern

if security is a concern (we *are* passing in the token directly in the url after all), passing in the token through the `Sec-WebSocket-Protocol` header could be an alternative, but i don't know if that's a major concern

JellyBrick commented

2025-09-09 13:41:55 +00:00

(Migrated from github.com)

@cxntered Your system appears to be affected by the color@5.0.1 vulnerability. We recommend checking your machine. See issue #3855 for details.

@cxntered Your system appears to be affected by the `color@5.0.1` vulnerability. We recommend checking your machine. See issue #3855 for details.

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin cxntered/feat/ws-authorization:cxntered/feat/ws-authorization

git switch cxntered/feat/ws-authorization

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master

git merge --no-ff cxntered/feat/ws-authorization

git switch cxntered/feat/ws-authorization

git rebase master

git switch master

git merge --ff-only cxntered/feat/ws-authorization

git switch cxntered/feat/ws-authorization

git rebase master

git switch master

git merge --no-ff cxntered/feat/ws-authorization

git switch master

git merge --squash cxntered/feat/ws-authorization

git switch master

git merge --ff-only cxntered/feat/ws-authorization

git switch master

git merge cxntered/feat/ws-authorization

git push origin master

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: YTMD/youtube-music#3854

No description provided.

Rows
Columns