Not sure if this relates to your immediate problem but > the login depends on the websocket connection The origin is forgeable for websocket connections 🙂

@U01BP1CB37B What i think is being protected by the server checking the origin is an http upgrade to ws request with a different (malicious) origin, that could exposed auth information in cookies. > The origin is forgeable for websocket connections Can you be explain more? I turned off the token because it was throwing errors for reasons i haven't gotten around to understanding, if you think that causes an issue i would love to know.

Sure -- I don't really have the context for your immediate problem but here's some reading that may be interesting 🙂 https://devcenter.heroku.com/articles/websocket-security#origin-header > However, remember that the Origin header is essentially advisory: non-browser clients can easily set the Origin header to any value, and thus “pretend” to be a browser. Meaning that if you're using the Origin header as some kind of security check on your backend, it can easily be forged by a malicious client

interesting, this is frustrating because of the massive amount of emphasis put on the origin.

i really should just use keycloak and just follow instructions verbatim.

could a non-browser client make a get request and get all the session cookies though?

Yea, i think it's safe. the malicious client can spoof the origin, but it won't get the cookies then, because it's not making the request from the browser which has them.

i mean, i would like to add the token, it's frustrating that i can't figure out why it's failing. But i'll circle back to it...

I added a comment to the old https://github.com/ptaoussanis/sente/pull/338 on senti about the concern, just to see if anyone can clarify.

For my use case, this bit summarizes the whole thing nicely: > A non-browser client, however, cannot access the session cookies stored in your browser. Even if the attacker spoofs Origin, their request will be denied because they’re not authenticated. > from https://dev.solita.fi/2018/11/07/securing-websocket-endpoints.html