[v5] Accessing Auth object out of http request

[esinanturan]

I am trying to verify a user making request from socket.io but i need to access auth object that comes with http request but here its not a instance of http request coming to the server so how can I process coming token from socket and verify that token ?

[McSneaky]

It has been answered in Discord several times, would be good if someone with working solution can give some code examples in here

But in general there are 2 ways to verify the user

• Add token to WS init URL
  When user signs in or initializes WS connection generate some token that is related to only that user
  Then add this token to URL, something like api.example.com/my-websocket**?userAuthToken=foobar**
  When WS connection is established then check the token

• Add cookie
  Add some kind of cookie that basically does the same as token in URL. Verifies that user is who tells to be

[McSneaky]

but don't you think its a need that we should be able to access auth object without a http request ?

That would be cool, but not really possible in NodeJS :| (without any hacks or insane performance hits)

[thetutlage]

@esinanturan How would you know who is loggedin if there is no HTTP request?

[esinanturan]

There will be a token sent through websocket so I can confirm if its valid or not but I have no access to auth object to check it

[ruanitto]

This is not the ideal way, but in my case I needed to generate a token via command, so I created a service where I did something here in Brazil called "Gambiarra":

import HttpContext from '@ioc:Adonis/Core/HttpContext';
import AuthManager from '@ioc:Adonis/Addons/Auth';

export default class GenerateTokenService {
  public static async generateTokenById (id: number) {
    const ctx = HttpContext.create('/', {})
    const auth = await AuthManager.getAuthForRequest(ctx)

    const token = await auth.loginViaId(id)

    return token.tokenHash
  }
}

[douglasdnzcarvalho]

Muito obrigado meu compatriota, em pleno 2024 não tem a documentação de como fazer isso sem se acoplar diretamente ao HTTP (pelo menos não até a última release da versão 5). Vou ficar na torcida pra que na versão 6 eles entendam que nem toda aplicação oferece APIs apenas nesse protocolo e que isso dificulta demais a criar um ponto único de autenticação.