Passing authentication from browser JS websocket

[wbobeirne]

Hey there, I see there are some docs about passing authorization using the Sec-Websocket-Protocol header. While this is a clever workaround, it doesn't appear as though it'll actually work for websockets started from the browser. From the MDN article on websockets, only registered IANA subprotocols can be passed. Attempting to pass Bearer, 123 results in

VM3291:1 Uncaught DOMException: Failed to construct 'WebSocket': The subprotocol 'Bearer, 123' is invalid.

Was this implemented with browser compatibility in mind? Or was the idea that cookies would be the only browser-friendly authorization method?

[AKopytenko]

+1
new WebSocket(address, 'Bearer,' + token )
Subprotocol is invalid.

How it's work?

[Goobs]

It should be

ws = new WebSocket(address, ['Bearer', token])

Browser concatenates subprotocol header by itself. No spaces or commas are allowed in header values.