{"id":19296532,"url":"https://github.com/esseswann/websocket-refresh-auth","last_synced_at":"2026-05-16T00:33:33.903Z","repository":{"id":125589965,"uuid":"326279479","full_name":"esseswann/websocket-refresh-auth","owner":"esseswann","description":"Proof of concept for JWT flow without Access Token using WebSockets","archived":false,"fork":false,"pushed_at":"2021-01-04T23:04:30.000Z","size":58,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-05T21:41:38.171Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/esseswann.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-01-02T22:05:07.000Z","updated_at":"2023-05-07T07:46:13.000Z","dependencies_parsed_at":null,"dependency_job_id":"c1fdeaa7-8f45-4869-8005-28abb22b236f","html_url":"https://github.com/esseswann/websocket-refresh-auth","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esseswann%2Fwebsocket-refresh-auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esseswann%2Fwebsocket-refresh-auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esseswann%2Fwebsocket-refresh-auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/esseswann%2Fwebsocket-refresh-auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/esseswann","download_url":"https://codeload.github.com/esseswann/websocket-refresh-auth/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240400293,"owners_count":19795331,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T22:47:07.576Z","updated_at":"2025-11-15T06:05:46.414Z","avatar_url":"https://github.com/esseswann.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# WebSocket Auth flow\n\n[![Project Status: WIP – Initial development is in progress, but there has not yet been a stable, usable release suitable for the public.](https://www.repostatus.org/badges/latest/wip.svg)](https://www.repostatus.org/#wip)\n\nThis repository is a proof of concept for JWT flow without Access Token. \\\nIt is implemented in Rust just to practice this language and does not rely on anything specific from it\n\n## Description\n\n### Fresh client\n- client connects through WebSocket\n- client sends authentication message\n- server checks the authentication message (next steps assume that the message is valid)\n- server returns a refresh token\n- server flags the client connection as `authenticated` by assigning the refresh token to the session\n- client stores the refresh token\n- server checks the refresh token assigned to the session in heartbeat calls\n- if refresh token is about to expire server sends a new one\n\n### Previously authorized client\n- client connects through WebSocket\n- client sends the refresh token\n- server checks the refresh token (next steps assume that the token is valid)\n- server blacklists the refresh token\n- server returns the new refresh token\n- server assigns the refresh token to the session for future heartbeat checks\n\n## Considerations\n### Horizontal scaling\nIt seems that nothing prevents from having multiple nodes of such service as long as\n- the refresh tokens are signed with JWK\\secret that's either same or can be independently validated\n- blacklist is independently accessible\n\n### Heartbeat\nThe refresh token check during heartbeat is used only for convenience following a consideration that performance penalty is negligible since the heartbeat is required anyway. \\\nAnother variant is to poractively request token refresh from client side\n\n### Cookies\nThe refresh token might also be added to the HTTPS cookie, but it would require breaking the WebSocket connection since the server can only set HttpOnly cookie in a response to the initial HTTP GET request.\nImplementing this approach can save a single initial message\n\n## How to use\nPull the docker image or build it yourself \\\nRun the image with whatever port mapped to 9001\n```\ndocker run -p 9001:9001 \u003ccontainer\u003e\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fesseswann%2Fwebsocket-refresh-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fesseswann%2Fwebsocket-refresh-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fesseswann%2Fwebsocket-refresh-auth/lists"}