[GH-ISSUE #321] Auth info on WebSocket connections #117

New issue

Closed

opened 2026-03-16 13:30:44 +03:00 by kerem · 3 comments

kerem commented

2026-03-16 13:30:44 +03:00

Owner

Originally created by @jensgram on GitHub (Nov 21, 2019).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/321

Originally assigned to: @liyasthomas on GitHub.

Is your feature request related to a problem? Please describe.
I'm not able to pass auth info on WebSocket connections.

Describe the solution you'd like
It would be nice to port the Authentication component (and possibly the Headers component too) from Request to WebSocket.

Describe alternatives you've considered
I may simply not be aware of how to use the UI. Perhaps it's already possible to pass auth info on WS connections?

Additional context
Current WS pane:
Screenshot 2019-11-21 at 09 06 43

Authentication and Headers components in Request pane:
Screenshot 2019-11-21 at 09 06 43

Originally created by @jensgram on GitHub (Nov 21, 2019). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/321 Originally assigned to: @liyasthomas on GitHub. **Is your feature request related to a problem? Please describe.** I'm not able to pass auth info on WebSocket connections. **Describe the solution you'd like** It would be nice to port the `Authentication` component (and possibly the `Headers` component too) from `Request` to `WebSocket`. **Describe alternatives you've considered** I may simply not be aware of how to use the UI. Perhaps it's already possible to pass auth info on WS connections? **Additional context** Current WS pane: <img width="284" alt="Screenshot 2019-11-21 at 09 06 43" src="https://user-images.githubusercontent.com/34647282/69318842-4e563680-0c3e-11ea-9485-18a011f3ed89.png"> `Authentication` and `Headers` components in `Request` pane: <img width="284" alt="Screenshot 2019-11-21 at 09 06 43" src="https://user-images.githubusercontent.com/34647282/69318812-426a7480-0c3e-11ea-95a8-b6b20ef7ea03.png">

kerem

2026-03-16 13:30:44 +03:00

closed this issue
added the
feature

good first issue
labels

kerem commented

2026-03-16 13:31:00 +03:00

Author

Owner

@liyasthomas commented on GitHub (Dec 6, 2019):

HTTP Authorization header problem can be addressed with the following:

ws://username:password@example.com/service

Then, a proper Basic Authorization HTTP header will be set with the provided username and password. If you need Basic Authorization, then you're all set.

If you want to use Bearer however, and I resorted to the following trick: I connect to the server as follows:

ws://my_token@example.com/service

And when connection at the server side receives Basic Authorization header with non-empty username and empty password, then it interprets the username as a token.

@liyasthomas commented on GitHub (Dec 6, 2019): HTTP Authorization header problem can be addressed with the following: ```ws://username:password@example.com/service``` Then, a proper Basic Authorization HTTP header will be set with the provided `username` and `password`. If you need `Basic Authorization`, then you're all set. If you want to use `Bearer` however, and I resorted to the following trick: I connect to the server as follows: ```ws://my_token@example.com/service``` And when connection at the server side receives `Basic Authorization` header with non-empty `username` and empty `password`, then it interprets the username as a token.

kerem commented

2026-03-16 13:31:05 +03:00

Author

Owner

@igorrocha commented on GitHub (Jan 3, 2020):

For anyone finding this issue now, it seems that the trick for passing an Authorization or Bearer header in the URL doesn't work anymore. It has been deprecated, as stated here.

The easiest way to pass auth information is through a querystring parameter, which doesn't pose a security issue if you're using wss. Another workaround involves server side Authentication, and is described here.

@igorrocha commented on GitHub (Jan 3, 2020): For anyone finding this issue now, it seems that the trick for passing an Authorization or Bearer header in the URL doesn't work anymore. It has been deprecated, as stated [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Access_using_credentials_in_the_URL). The easiest way to pass auth information is through a querystring parameter, which doesn't pose a security issue if you're using wss. Another workaround involves server side Authentication, and is described [here](https://devcenter.heroku.com/articles/websocket-security#authentication-authorization).

kerem commented

2026-03-16 13:31:10 +03:00

Author

Owner

@liyasthomas commented on GitHub (Jan 4, 2020):

Thanks for sharing the information 🙌🏼

@liyasthomas commented on GitHub (Jan 4, 2020): Thanks for sharing the information 🙌🏼

kerem referenced this issue

2026-03-17 00:07:28 +03:00

[PR #117] [MERGED] Add version number to footer and improves .editorconfig #2418