How to Handle Authorization for WebSockets?

In my case, since I have a dedicated backend API, the JWT gets passed with every request anyway, so it’s not much of an issue for me.

I suggest using very short-lived tokens, like 5 minutes or even less, and set it up to request a new token from the API if the connection drops.

You could also have the client send a cookie with the token along with the initial connection request, just like any regular request.

You really don’t need a token that lasts longer than the WebSocket connection itself. Once you’ve established the connection, you have an authenticated link with the user. So, focus on using a short-lived token solely for the initial authentication. After that, you can associate the user ID with the socket server-side. Just make sure you’re using a TLS-encrypted connection (wss://), since that keeps things secure similar to any other request from the user's browser. The WebSocket server can validate the token upon connection and drop the connection if it’s invalid.

Exactly! Just use a short-lived token to establish the connection. You could even pre-validate the token during the initial upgrade request to prevent invalid tokens from establishing the socket in the first place. Plus, I’ve used the `Sec-WebSocket-Protocol` header to send the token since that’s the only header available during a socket request, although it might not be the best method.