Sorry to necro an old thread here, but @Exadra37 did you ever reach a good alternative solution for this? I tried to do a similar approach to your rewrite-as-an-x-header-via-plug approach and came up with the same ineffective result.
jpramassini
Exadra37
I had to resort to use the x-header approach enforced by Phoenix, because the framework it’s inflexible in this regard.
0
josevalim
Creator of Elixir
The reason why this is not allowed is due to poor browser security. WebSockets are cross-domain, which means that, if you authenticate into a WebSocket with cookie/auth headers, an attacker on a completely different website can use the same credentials to open up and control a WebSocket with your credentials on any website.
Even if you plan to use WebSockets outside of the browser, in my humble opinion, just use the x-headers, as otherwise it is not worth introducing such a big hole in your app. If you want to risk it anyway, latest Plug (v1.14+) and Phoenix (v1.7+) allows you to upgrade any connection to a WebSocket, so that could be used instead. Here is an example: GitHub - elixir-plug/plug: Compose web applications with functions · GitHub
1
rogerweb
About the part “otherwise you just disconnect them”, do you have any ideas on how to implement it? I’m assuming you meant “disconnect if the user doesn’t authenticate in X seconds”.
What I have tried
In the user socket’s connect/3
- Schedule an
:auth_timeoutmessage usingProcess.send_after/3toself() - Save the timer reference into the socket assigns
- Handle the
:auth_timeoutand disconnects the socket.
In the user channel’s join/3
- Cancel the timer once the user authenticates.
However, Phoenix.Socket brings its own handle_info(message, state) that matches everything. So instead of sending my custom :auth_timeout, I tried sending a %Broadcast{event: "disconnect"} that I see in the source code. However, it looks the process that runs the connect/3 is not the same that would be listening for these messages, so nothing happens.
Do you know which process would it be?
0
rogerweb
I’ve figured it out: it’s the Cowboy’s process :cowboy_clear.connection_process/4. You can get its PID from the socket’s connect/3 like this:
{:links, [pid]} = Process.info(self(), :links)
Then you create a timer to disconnect the socket using something like:
timer_ref = Process.send_after(pid, %Broadcast{event: "disconnect"}, 3000)
Save the timer_ref in the socket’s assigns and cancel it later in the Channel’s join, like:
Process.cancel_timer(socket.assigns.auth_timer)
2