how to secure websocket connection

[kingter-sutjiadi]

hi just wandering how to secure websocket connection so not all user can join my connection only from my APP and WEB only, can i give middleware before go trough the connection?

[SadieCat]

You need to configure a WebSocket origin. See https://docs.inspircd.org/4/modules/websocket/#wsorigin for more information.

[kingter-sutjiadi]

so if the non-web irc application connect using WS protocol when i already set the wsorigin it won't be affected and still able to connect, right?

thank you,

anyway is there any method to secure the TCP connection ?

[SadieCat]

Non-web clients are not subject to origin filtering because its pointless for them as they can just lie about their origin. If you want to secure a server you should require accounts.

[kingter-sutjiadi]

hi, can you show me the documentation about "require accounts"

Thank you 🙏

[SadieCat]

https://docs.inspircd.org/4/modules/account/#connect

You will need to set up a pre-connect class with no account requirement for users to be given time to authenticate something like this:

https://docs.inspircd.org/4/configuration/useful-snippets/#requiring-connections-to-use-sasl

[kingter-sutjiadi]

ok thanks a lot @SadieCat 👍 🙏