Rahul Roy 1 Year Ago - Edited Thanks David for the blog. I have couple of queries. Let me give you some context, We are using liferay headless as backend and front end as React JS/Mobile Apps. We are planning to use web socket for user's notifications so client does not need to call our rest(graphql) API at specific interval and they get instant notifications whenever we push from backend. So I want to know, 1. web socket would be right choice for this scenario? 2. If yes, How I can authenicate user for web socket end point? Thanks in advance. Please sign in to reply. Reply as... Cancel David H Nebinger Rahul Roy 1 Year Ago - Edited Sure, sounds like the kind of thing WebSockets was designed for. The WS spec is kind of light on any kind of supported auth mechanism, and Liferay doesn't give you one either. The common implementations you find elsewhere such as "first message sent is authentication" would work, your implementation can read the message and invoke the Liferay auth pipeline too. Alternatively if you have the p_auth cookie (from logged into Liferay via browser), you can use PortalUtil's methods to get the current user from the http request, so that can be kind of transparent. One alternative that popped into my head, a headless method that returns a token value and then that token is passed in as a parameter (or first message) that the server code validates... I guess there's a number of ways to skin this cat, you just have to find the method that works best in your environments... Please sign in to reply. Reply as... Cancel
David H Nebinger Rahul Roy 1 Year Ago - Edited Sure, sounds like the kind of thing WebSockets was designed for. The WS spec is kind of light on any kind of supported auth mechanism, and Liferay doesn't give you one either. The common implementations you find elsewhere such as "first message sent is authentication" would work, your implementation can read the message and invoke the Liferay auth pipeline too. Alternatively if you have the p_auth cookie (from logged into Liferay via browser), you can use PortalUtil's methods to get the current user from the http request, so that can be kind of transparent. One alternative that popped into my head, a headless method that returns a token value and then that token is passed in as a parameter (or first message) that the server code validates... I guess there's a number of ways to skin this cat, you just have to find the method that works best in your environments... Please sign in to reply. Reply as... Cancel