WS auth middleware: validate session on upgrade #34

New issue

Open

opened 2026-04-19 07:23:36 +00:00 by forgejo-lila · 0 comments

forgejo-lila commented

2026-04-19 07:23:36 +00:00

Owner

Context

WebSocket connections must be authenticated. The session cookie is sent during the HTTP upgrade handshake.

What to do

Validate Better Auth session during WebSocket upgrade. Reject unauthenticated connections.

Files to create/change

apps/api/src/ws/auth.ts — new file. Extract and validate session from upgrade request.
apps/api/src/ws/index.ts — call auth during upgrade event.

Implementation outline

import { fromNodeHeaders } from 'better-auth/node';
import { auth } from '../lib/auth.js';

export async function authenticateWs(request: IncomingMessage) {
  const session = await auth.api.getSession({
    headers: fromNodeHeaders(request.headers),
  });
  return session; // null if not authenticated
}

Acceptance criteria

Unauthenticated upgrade requests rejected with 401
Authenticated connections have user/session info attached
Cookie-based session works across subdomains (COOKIE_DOMAIN=.lilastudy.com)
Unit tests for the auth function

Notes

Reference: apps/api/src/middleware/authMiddleware.ts uses same auth.api.getSession() pattern but with Express Request. WebSocket version uses raw IncomingMessage headers.

## Context WebSocket connections must be authenticated. The session cookie is sent during the HTTP upgrade handshake. ## What to do Validate Better Auth session during WebSocket upgrade. Reject unauthenticated connections. ## Files to create/change - `apps/api/src/ws/auth.ts` — new file. Extract and validate session from upgrade request. - `apps/api/src/ws/index.ts` — call auth during upgrade event. ## Implementation outline ```typescript import { fromNodeHeaders } from 'better-auth/node'; import { auth } from '../lib/auth.js'; export async function authenticateWs(request: IncomingMessage) { const session = await auth.api.getSession({ headers: fromNodeHeaders(request.headers), }); return session; // null if not authenticated } ``` ## Acceptance criteria - Unauthenticated upgrade requests rejected with 401 - Authenticated connections have user/session info attached - Cookie-based session works across subdomains (COOKIE_DOMAIN=.lilastudy.com) - Unit tests for the auth function ## Notes Reference: `apps/api/src/middleware/authMiddleware.ts` uses same `auth.api.getSession()` pattern but with Express Request. WebSocket version uses raw `IncomingMessage` headers.