title: GraphQL Subscriptions - Spring Boot Websocket Authentication
body: <p>We are using the <a href="https://netflix.github.io/dgs/" rel="nofollow noreferrer">Netflix DGS</a> framework to build our backend to provide a GraphQL API.</p>
  <p>In addition to that we use <a href="https://www.keycloak.org/docs/latest/securing_apps/" rel="nofollow noreferrer">Keykloak</a> as an identity provider which comes with a handy Spring module to add support for authentication and authorization out of the box.</p>
  <p>Every request contains a JWT token, which gets validated and from there a SecurityContext object is being generated which is then available in every endpoint.</p>
  <p>This is working great for HTTP requests. GraphQL queries and mutations are sent via HTTP, therefore no problem here.</p>
  <p>Subscriptions on the other hand use the web socket protocol. A WS request does not contain additional headers, therefore no JWT token is sent with the request.</p>
  <p>We can add the token via a payload, the question is now how to set up a Spring Security Filter which creates a Security Context out of the payload.</p>
  <p>I guess this is rather Spring specific, basically a filter which intercepts any web socket request (ws://... or wss://...) is needed.</p>
  <p>Any help or hint is very much appreciated!</p>