JavaScript(Node.js + Express)でWebSocketの認証方法サンプル

_wss_auth_js.md

tsのが良かったかもしれん

NYSL(煮るなり焼くなり好きにしろライセンス)

basic.js

const express = require('express');
const WebSocket = require('ws');

const app = express();
const wss = new WebSocket.Server({ noServer: true });
const server = app.listen(3000);

server.on('upgrade', (request, socket, head) => {
  const auth = request.headers.authorization;
  
  if (!auth || !isValidBasicAuth(auth)) {
    socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
    socket.destroy();
    return;
  }

  wss.handleUpgrade(request, socket, head, (ws) => {
    wss.emit('connection', ws, request);
  });
});

function isValidBasicAuth(auth) {
  const [scheme, credentials] = auth.split(' ');
  if (scheme !== 'Basic') return false;
  
  const [username, password] = Buffer.from(credentials, 'base64')
    .toString()
    .split(':');
    
  return username === 'user' && password === 'password';
}

cookie.js

const express = require('express');
const WebSocket = require('ws');
const cookieParser = require('cookie-parser');
const session = require('express-session');

const app = express();
app.use(cookieParser());
app.use(session({
  secret: 'session-secret',
  resave: false,
  saveUninitialized: false
}));

const wss = new WebSocket.Server({ noServer: true });
const server = app.listen(3000);

server.on('upgrade', (request, socket, head) => {
  const cookies = cookieParser.signedCookies(request.headers.cookie, 'session-secret');
  const sessionId = cookies['connect.sid'];

  if (!sessionId) {
    socket.destroy();
    return;
  }

  wss.handleUpgrade(request, socket, head, (ws) => {
    wss.emit('connection', ws, request);
  });
});

customproto.js

const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 3000 });

wss.on('connection', (ws) => {
  let isAuthenticated = false;
  
  ws.on('message', (message) => {
    if (!isAuthenticated) {
      try {
        const authMessage = JSON.parse(message);
        if (authMessage.type === 'auth' && 
            authMessage.username === 'user' && 
            authMessage.password === 'password') {
          isAuthenticated = true;
          ws.send(JSON.stringify({ type: 'auth', status: 'success' }));
        } else {
          ws.close();
        }
      } catch (err) {
        ws.close();
      }
      return;
    }
    // 認証後のメッセージ処理
    if (isAuthenticated) {
      // 通常のメッセージ処理
    }
  });
});

jwt.js

const express = require('express');
const jwt = require('jsonwebtoken');
const WebSocket = require('ws');
const url = require('url');

const app = express();
const wss = new WebSocket.Server({ noServer: true });
const JWT_SECRET = 'your-secret-key';

const server = app.listen(3000);

server.on('upgrade', (request, socket, head) => {
  const { query } = url.parse(request.url, true);
  const token = query.token;

  try {
    jwt.verify(token, JWT_SECRET);
    wss.handleUpgrade(request, socket, head, (ws) => {
      wss.emit('connection', ws, request);
    });
  } catch (err) {
    socket.destroy();
  }
});