Prevent client from including a request authorization header

[hueniverse]

No description provided.

[devinivy]

What's the reasoning here? I guess I'm not sure what the relationship is meant to be between existing auth strategies on routes and the auth strategy used to authenticate the socket connection.

[hueniverse]

The entire connection must have a single auth otherwise the security properties of this connection are undefined and fluid.

[devinivy]

Are credentials used to authenticate the socket connection also used with requests to routes over sockets? I mean, how would a route authentication strategies be applicable at all over sockets? This is very confusing to me. For example, I might have different bearer tokens for different routes based upon the auth strategies that are used for those routes. And if I can provide those tokens, then what's the problem?

[hueniverse]

The WebSocket connection behaves like a single endpoint for authentication purposes. This is not a blank channel to send random HTTP requests over, each with their own headers. I have never seen a design where a single client uses multiple authentication credentials against one server.

So if your requirements are to authenticate a single client using different credentials for different endpoints, this would not be the right solution for you. I am not going to allow changing authentication state once a channel is initialized.

[devinivy]

This makes more sense after seeing that the credentials/artifacts from the original websocket request are used when invoking routes to bypass any existing auth strategy. I didn't know that was happening, or that server.inject() even allowed for that! I think the auth section of the nes docs gave me a little trouble too. In any case, thanks for bearing with my questions.

[hueniverse]

Happy to take a PR to make things clearer. The docs are not really for users at this point. They are mostly for me to keep track of everything I'm doing. At some point someone will need to write a proper guide for this module... It got big FAST.