Support transport agnostic token passing in channels#6086
Conversation
For WebSocket, the `Sec-WebSocket-Protocol` header is used. For LongPoll, an `Authorization` header is passed instead. Fixes #5778.
| |> Transport.check_origin(handler, endpoint, opts) | ||
| |> Transport.check_subprotocols(opts[:subprotocols]) | ||
| |> maybe_auth_token_from_header(opts[:auth_token]) | ||
| |> Transport.check_subprotocols(subprotocols) |
There was a problem hiding this comment.
Honestly, it feels we should just bring this function to this module and have it deal with both auth_token and subprotocols at once, or move auth_token to check subprotocols. Transport is meant to have transport agnostic functions, and that one is clearly websockets related, so it shouldn't exist in the first place.
There was a problem hiding this comment.
It is part of the public API, so we can't really change it, can we?
https://hexdocs.pm/phoenix/Phoenix.Socket.Transport.html#check_subprotocols/2
There was a problem hiding this comment.
Yes, we cannot, but maybe we can move the auth token handling there anyway?
josevalim
left a comment
josevalim
left a comment
There was a problem hiding this comment.
LGTM. I have dropped a comment about subprotocol handling but it can be handled in a future PR!
2 participants
For WebSocket, the
Sec-WebSocket-Protocolheader is used. For LongPoll, anAuthorizationheader is passed instead.Fixes #5778.