title: Providing auth header with SockJS
body: <p>I have a Spring MVC server that provides a bunch of REST endpoints as well as a websocket endpoint.  Everything except the login endpoint requires authentication.  I'm using JWT to authenticate requests coming from the client.</p>
  
  <p>When the user logs in I'm returning an X-AUTH-TOKEN header, containing the JWT token.  This token is then passed in the same header on every request to the server.  This all works fine for the REST endpoints, but I can't figure out how to do this on the websocket.</p>
  
  <p>I'm using SockJS, and when I open the connection:</p>
  
  <pre><code>var socket = new SockJS('/socket/updates', null, {});
  </code></pre>
  
  <p>This causes a GET request to /socket/updates/info?t=xxx which returns a 403 (as everything requires auth by default).</p>
  
  <p>Ideally I'd simply send my X-AUTH-TOKEN header on any XHR requests SockJS makes, but I can't see any way of adding headers looking at the API.</p>
  
  <p>Worst case I can change SockJS to do this, but I'm wondering whether this functionality has been deliberately left out? I know SockJS doesn't support cookies for security reasons but that's not what I'm trying to do.</p>
  
  <p>Also, for the sake of a test I did allow the info endpoint to have anonymous access but then it 403's on a bunch of other endpoints - it feels more elegant to simply pass in auth details on these requests than poke holes in my server security.</p>
  
  <p>Any help appreciated.</p>
  
  <p>Cheers</p>