title: Mosquitto websockets security best practice
body: <p>I have a <strong>Mosquitto</strong> server running on which I activated the <strong>websocket</strong> listener. All works fine, I can subscribe/publish from an Angular application. I did not activate SSL from Mosquitto, but I did reverse-proxy using Nginx, effectively encrypting the websocket. I cannot access via <code>ws</code>, only via <code>wss</code>.</p>
  
  <p>Now what is the best practice to restrict connection to the websocket to authenticated users only? Enabling the location to the outside world would make the MQTT server encrypted, but available to all. Is there a way to restrict connection to only authenticated user, and if so, how?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>Thanks to @john-romkey's clarifications, I can now activate authentication on Mosquitto side and enable a user that would be limited for the operations needed by the web client. The documentation also mentions <em>authentication plugins</em>, so I wonder if there is any token based authentication plugin that would remove the need for passing a user/pass to the front-end.</p>