# Access HTTP headers in websocket-in node to link user to session ID

**URL:** <https://discourse.nodered.org/t/access-http-headers-in-websocket-in-node-to-link-user-to-session-id/100836>\
**Category:** General\
**Tags:** websocket\
**Created:** [24 April 2026 10:30 UTC](https://discourse.nodered.org/t/access-http-headers-in-websocket-in-node-to-link-user-to-session-id/100836 "2026-04-24T10:30:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lupin\_III](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lupin_iii/32/67650_2.png) [@Lupin\_III](https://discourse.nodered.org/u/Lupin_III)\
**Post date:** [24 April 2026 10:30 UTC](https://discourse.nodered.org/t/access-http-headers-in-websocket-in-node-to-link-user-to-session-id/100836/1 "2026-04-24T10:30:21Z")

</div>

Hi,  
I have a Node-RED setup behind Nginx. When a WebSocket connection is established, Nginx injects a verified `X-Myapp-User` header into the handshake request.  
Using `webSocketNodeVerifyClient` in `settings.js` I can read this header:

```auto
webSocketNodeVerifyClient: function(info) {
    const user = info.req.headers['x-myapp-user'] || '';
    console.log('user:', user); // works fine
    return true;
}

```

The problem is linking this `user` to the `_session.id` that Node-RED assigns to the connection and that appears in `msg._session.id` inside the flow.  
The `_session.id` is generated by `RED.util.generateId()` inside `handleConnection()` — after `verifyClient` has already returned. So at the time of `verifyClient`, the session ID doesn't exist yet.  
Is there any documented/stable way to:

1. Store the user from `verifyClient`
2. Retrieve it later in the flow associated with the correct `_session.id`

Without modifying core files or writing a custom node?  
Thanks

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [24 April 2026 17:06 UTC](https://discourse.nodered.org/t/access-http-headers-in-websocket-in-node-to-link-user-to-session-id/100836/2 "2026-04-24T17:06:09Z")

</div>

Hi @Lupin_III

Having had a look at the options, this one is "hard"

One way to allow this,  
Here: [node-red/packages/node\_modules/@node-red/nodes/core/network/22-websocket.js at 7231e3d7658927c49d5b5756de28904a04b40c76 · node-red/node-red · GitHub](https://github.com/node-red/node-red/blob/7231e3d7658927c49d5b5756de28904a04b40c76/packages/node_modules/%40node-red/nodes/core/network/22-websocket.js#L352)

Include the `req` as part of the event object

if you ask nicely of @dceejay, im sure he will be obliged.  
This way, you can use the `status` node to match both the User Header + session ID

Unless I am missing some other obvious method (Possible)

I do agree however, having access to the initial request object, should be provided inside the flow

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [25 April 2026 16:32 UTC](https://discourse.nodered.org/t/access-http-headers-in-websocket-in-node-to-link-user-to-session-id/100836/3 "2026-04-25T16:32:41Z")

</div>

Not quite getting my head around this as it's the weekend - but happy to look at a PR if someone creates one.

---

<div class="post-metadata">

**Author:** ![Lupin\_III](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lupin_iii/32/67650_2.png) [@Lupin\_III](https://discourse.nodered.org/u/Lupin_III)\
**Post date:** [27 April 2026 10:27 UTC](https://discourse.nodered.org/t/access-http-headers-in-websocket-in-node-to-link-user-to-session-id/100836/4 "2026-04-27T10:27:38Z")

</div>

OK, thanks so much

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [26 July 2026 10:28 UTC](https://discourse.nodered.org/t/access-http-headers-in-websocket-in-node-to-link-user-to-session-id/100836/5 "2026-07-26T10:28:37Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.