# Allow adding headers to WebSocket client?

**URL:** <https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842>\
**Category:** Feature Requests\
**Tags:** websocket\
**Created:** [13 November 2023 20:03 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842 "2023-11-13T20:03:55Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [13 November 2023 20:03 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/1 "2023-11-13T20:03:55Z")

</div>

So...

I have just needed to manually code up a web socket client `function` node, in order to pass custom headers (i.e bearer token) to a WebSocket server

I was surprised this is not already allowed.

As per guidelines, I am putting it here, before I maybe put up a PR to add custom headers in client mode.

it will be similar to setting headers in the `http request` node, only the values will only be able to be set from a static string or `env`, `flow` or `global` due to the connection not being made lazily.

Is there a blocker stopping this enhancement?  
any areas of concern?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [13 November 2023 20:13 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/2 "2023-11-13T20:13:44Z")

</div>

I vaguely remember this being asked for previously? If so, can't remember the outcome.

I can't think of a reason you wouldn't want this. Though the documentation should make it clear that custom headers are only valid when a websocket makes its initial http(s) connection. They disappear when the connection upgrades to ws(s). And obviously, you should not be passing bearer tokens without using https/wss.

So bearer tokens on websocket connections are only good for the initial connection, you cannot, for example use a JWT to track a session when using websockets. You have to include the JWT in the ws messages instead. [Socket.IO](http://Socket.IO) has a client auth object that lets you pack custom information into the client connections to help get round this issue.

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [13 November 2023 20:17 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/3 "2023-11-13T20:17:01Z")

</div>

Yup,

The initial auth token was just the example I needed to work with today.  
But got me thinking why custom headers aren't already supported, when the `ws` module fully supports it.

Allowing support should be trivial, so shouldn't take me to long to implement the enhancement, if it gets the green light.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [13 November 2023 20:49 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/4 "2023-11-13T20:49:30Z")

</div>

Can't see why not. Gets my vote

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [13 November 2023 21:40 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/5 "2023-11-13T21:40:30Z")

</div>

Example  
If no objection/concern arrises I'll put up a PR in a few days

 ![Screenshot 2023-11-13 at 21.40.15](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/0/3/0371afca18b30b37c47a1abd79756a0bed74e47f.png)

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [13 November 2023 23:21 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/6 "2023-11-13T23:21:48Z")

</div>

Based off dev branch please

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [14 November 2023 00:11 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/7 "2023-11-14T00:11:42Z")

</div>

I would suggest you stick to the header options the http request node offers (as opposed to adding jsonata etc).

It may even make sense to refactor the code that provides the existing options so that they are centralised?

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [14 November 2023 07:36 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/8 "2023-11-14T07:36:27Z")

</div>

> [@Steve-Mcl](#):
>
> It may even make sense to refactor the code that provides the existing options so that they are centralised?

Is there already suitable foundations in place that is providing central lookups?  
if so, any hints on where to look, so I can append to it?

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [14 November 2023 09:03 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/9 "2023-11-14T09:03:04Z")

</div>

I don't think so... for now I would just copy that code from the request node.

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [14 November 2023 21:22 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/10 "2023-11-14T21:22:21Z")

</div>

The PR is up.

> <https://github.com/node-red/node-red/pull/4436>
>
> \- \[\] Bugfix (non-breaking change which fixes an issue)
> \- \[x\] New feature (non-…breaking change which adds functionality)
> 
> \## Proposed changes
> 
> This PR adds the ability to set Headers for the WebSocket client.
> a lot of the editor code was lifted from the \`HTTP Request\` node, with some small differences.
> 
> - Values are iether typed or can be taken from \`env\`, \`global\` or a static string
> - Similarly, the header names can only be set from a typed value, or a static string
> 
> The hint text has been updated, to state that headers are only used during the Upgrade routine, and this message has been translated accordingly.
> 
> A few checks are in place, to ensure users who have not provided a headers object in the node (i.e they are in receipt of this change without making changes) does not cause an \`undefined\` error
> 
> !\[Screenshot 2023-11-14 at 21 21 23\](https://github.com/node-red/node-red/assets/55892693/69533836-6b13-4966-b77a-a80fbff6d249)
> 
> 
> \## Checklist
> 
> 
> \- \[x\] I have read the \[contribution guidelines\](https://github.com/node-red/node-red/blob/master/CONTRIBUTING.md)
> \- \[\] For non-bugfix PRs, I have discussed this change on the forum/slack team.
> \- \[x\] I have run \`npm run test\` to verify the unit tests pass
> \- \[\] I have added suitable unit tests to cover the new/changed functionality

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [13 January 2024 21:22 UTC](https://discourse.nodered.org/t/allow-adding-headers-to-websocket-client/82842/11 "2024-01-13T21:22:51Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.