title: Authenticate websocket clients using tokens?
body: <p>I want to provide a websocket based Service to my registered users. 
  The Website Frontend is running on Server A, the WebSocket-Service is running on Server B.</p>
  
  <p>I want to make sure that Server B won't grant acces to an user that is not authenticated by Server A. Also I want to avoid that a session can be hijacked.</p>
  
  <p>I came up with this approach but I never implemented security for websockets.
  Might this be a good approach?:</p>
  
  <ul>
  <li><p>When a client wants to connect with my WebSocket, Server A requests a
  token from Server B. The Server B will generate this Token and send
  it back to Server A.</p></li>
  <li><p>Server B will store the token in a cache.</p></li>
  <li><p>Now the client is allowed to connect to the WebSocket. The clients
  first Message contains the token.</p></li>
  <li><p>Server B checks whether the token can be found in the cache and
  whether the token is already used by an active Session.</p></li>
  <li><p>If everything is fine the client will be registered and is allowed
  use the service.</p></li>
  </ul>
  
  <p>Is this a good approach? Is there a better solution I wont have to implement by myself?</p>
  
  <p>I read this solution:
  <a href="https://stackoverflow.com/questions/1432664/best-way-to-create-a-token-system-to-authenticate-web-service-calls">Best way to create a TOKEN system to authenticate web service calls?</a></p>
  
  <p>But since my users will send up to 500 messages per minute (thats the highest possible value..but still possuble) I think this could cause some trouble...</p>