title: Websocket Authentication and Authorization in Spring
body: <p>I've been struggling a lot to properly implement Stomp (websocket) <strong>Authentication</strong> and <strong>Authorization</strong> with Spring-Security. <em>For posterity i'll answer my own question to provide a guide.</em></p>
  <br />
  <h3>The Problem</h3>
  <p>Spring WebSocket documentation (for Authentication) looks unclear ATM (IMHO). And i couldn't understand how to properly handle <strong>Authentication</strong> and <strong>Authorization</strong>.</p>
  <br />
  <h3>What i want</h3>
  <ul>
  <li>Authenticate users with login/password.</li>
  <li>Prevent anonymous users to CONNECT though WebSocket.</li>
  <li>Add authorization layer (user, admin, ...).</li>
  <li>Having <code>Principal</code> available in controllers.</li>
  </ul>
  <br />
  <h3>What i don't want</h3>
  <ul>
  <li>Authenticate on HTTP negotiation endpoints (since most of JavaScript libraries don't sends authentication headers along with the HTTP negotiation call).</li>
  </ul>