title: Websockets token authentication using middleware and express in node.js
body: <p>I use node.js, express and <a href="https://www.npmjs.com/package/express-ws" rel="nofollow noreferrer">express-ws</a> that is based on <a href="https://github.com/websockets/ws" rel="nofollow noreferrer">ws</a> </p>
  
  <p>Express-ws allows to create express-like endpoints for websockets.</p>
  
  <p>I am looking for a solution to authenticate users in websocket connections, based on a token. Since my ws server is based on an HTTP one</p>
  
  <pre><code>const wsHttpServer = http.createServer();
  wsHttpServer.listen(5001);
  const expressWs = require('express-ws')(app , wsHttpServer);
  </code></pre>
  
  <p>and since the ws connection is based on an HTTP one that gets upgraded to a ws, WHY I cannot pass a token in my ws that the express route checks, like any other one? My logic is, send the token, check it, if it is ok, proceed to upgrade to a ws connection. So, I can reuse the token-middleware solution that I have in my HTTP connections.</p>
  
  <p><strong>In node</strong></p>
  
  <p>My ws server </p>
  
  <pre><code>const wsHttpServer = http.createServer();
  wsHttpServer.listen(5001);
  const expressWs = require('express-ws')(app , wsHttpServer);
  
  //set the route
  
  app.use('/ws', require('./routes/wsroute')); 
  </code></pre>
  
  <p>In that route, I would like to use the <code>token.validate()</code> middleware -that in HTTP connections, checks the Authorization header</p>
  
  <pre><code>router.ws('/user/:name/:id', token.validate(),  (ws, req) =&gt; { 
      console.log('ws route data : ',vessel, req.params.name, req.params.id);
  });
  </code></pre>
  
  <p><strong>In my client</strong></p>
  
  <pre><code>    const socket = new WebSocket('ws://localhost',{
          path: '/user/Nick/25/',
          port: 5001, // default is 80
          protocol : "echo-protocol", // websocket protocol name (default is none)
          protocolVersion: 13, // websocket protocol version, default is 13
          keepAlive: 60,
          headers:{ some:'header', 'ultimate-question':42 } // websocket headers to be used e.g. for auth (default is none)
        });
  </code></pre>
  
  <p>this errors <code>Failed to construct 'WebSocket': The subprotocol '[object Object]' is invalid</code></p>
  
  <p>I also tried </p>
  
  <p><code>const socket = new WebSocket('ws://localhost:5001/user/Nick/25', ["Authorization", localStorage.getItem('quad_token')]);</code></p>
  
  <p>I dont get any errors, but I dont know how to get the <code>Authorization</code> "header" in node</p>
  
  <p><strong>I could</strong></p>
  
  <p>just send <code>const socket = new WebSocket(currentUrl);</code> with some data and include a valid token in that data. But to check it, I have to allow the connection first. I dont want that, I would like to use a middleware solution that automatically checks a token and allows or not to continue.</p>
  
  <p><strong>Questions</strong></p>
  
  <p>Please help me understand: </p>
  
  <p>1 Is it possible to use a token-based, middleware-based solution in ws?</p>
  
  <p>2 How to set a header with a token in a ws connection? </p>
  
  <p>3 How to get that token in node?</p>