# How to enhance 'websocket in' with basic authorization header?

**URL:** <https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199>\
**Category:** General\
**Tags:** security\
**Created:** [31 August 2022 20:48 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199 "2022-08-31T20:48:16Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![b0denl0s](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/b0denl0s/32/67059_2.png) [@b0denl0s](https://discourse.nodered.org/u/b0denl0s)\
**Post date:** [31 August 2022 20:48 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/1 "2022-08-31T20:48:16Z")

</div>

Hi,  
my local smart home system has some "special requirement" on how to connect to their websocket:  
_(...) you require a websocket implementation that: Supports providing headers to the connection request._  
[https://developer.eu.mybuildings.abb.com/fah\_local/samples/#open-a-websocket-connection](https://developer.eu.mybuildings.abb.com/fah_local/samples/#open-a-websocket-connection)

I cannot find any way to enhance the built-in 'websocket in' node with an authorization header for basic auth, or any proper "workaround"...  
I have already tried [node-red-contrib-custom-header-ws](https://flows.nodered.org/node/node-red-contrib-custom-header-ws), but that node does not run stable.

Are there any ideas? I am also open for _suboptimal solutions_ regarding security, it is only within may LAN... 😉 It has to be a stable connect at least.

Brgds  
/Frank

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [1 September 2022 14:12 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/2 "2022-09-01T14:12:42Z")

</div>

Well, that is annoying - I've searched through the flows can I can't see anything that does what you want surprisingly. Lots of custom websocket connections to specific endpoints but nothing generic I can see.

First step would be to raise a GitHub issue against that custom-header-ws node to see if the author is responsive.

However, it really it needs the core websocket node enhancing to allow specification of headers. Not that uncommon a requirement. You could submit it as an enhancement request but I'm not sure who might have bandwidth to work on it if you aren't able to do a pull request yourself.

@knolleary or @Steve-Mcl - any other thoughts?

---

<div class="post-metadata">

**Author:** ![b0denl0s](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/b0denl0s/32/67059_2.png) [@b0denl0s](https://discourse.nodered.org/u/b0denl0s)\
**Post date:** [1 September 2022 15:59 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/3 "2022-09-01T15:59:54Z")

</div>

I will try to contact the author (lorenzhoh) directly with my findings and analysis (have already an idea what's going wrong). But the package has been deprecated:  
[https://www.npmjs.com/package/node-red-contrib-custom-header-ws](https://www.npmjs.com/package/node-red-contrib-custom-header-ws)  
So I do not expect a solution.

Fully agree with your valuation. Also thought that it should not be such an uncommon requirement, but did not find any generic custom node or flow either solving these problem.

Unfortunately I am not able to implement that enhancement and raise a pull request (due to lack of coding skills ;-))

---

<div class="post-metadata">

**Author:** ![b0denl0s](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/b0denl0s/32/67059_2.png) [@b0denl0s](https://discourse.nodered.org/u/b0denl0s)\
**Post date:** [1 September 2022 21:54 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/4 "2022-09-01T21:54:10Z")

</div>

I have raised an issue on [GitHub](https://github.com/LorenzHoh/CustomWebsocket/issues/1).  
Let's see if 'Lorenzhoh' can support or fix it. Or maybe implement the 'header authorization feature' within core websocket node and raise an PR?

---

<div class="post-metadata">

**Author:** ![deltaecho07](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/deltaecho07/32/68244_2.png) [@deltaecho07](https://discourse.nodered.org/u/deltaecho07)\
**Post date:** [24 September 2022 18:45 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/5 "2022-09-24T18:45:57Z")

</div>

Hi,

I recently updated Lorenzhoh's library. It now accepts a Bearer Token for authorization and returns the message in JSON-format. You can find the new npm package [here](https://www.npmjs.com/package/node-red-contrib-ws-subscriber-custom-deltaecho07).

If you need another type of authorization header, you're welcome to raise an issue on [GitHub](https://github.com/deltaecho07/CustomWebsocket/issues)

---

<div class="post-metadata">

**Author:** ![b0denl0s](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/b0denl0s/32/67059_2.png) [@b0denl0s](https://discourse.nodered.org/u/b0denl0s)\
**Post date:** [27 September 2022 19:24 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/6 "2022-09-27T19:24:57Z")

</div>

Sorry @deltaecho07, but I don’t see any relation to topic and thread above.

---

<div class="post-metadata">

**Author:** ![b0denl0s](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/b0denl0s/32/67059_2.png) [@b0denl0s](https://discourse.nodered.org/u/b0denl0s)\
**Post date:** [27 September 2022 19:30 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/7 "2022-09-27T19:30:17Z")

</div>

Anybody with capacity who is able to implement “header authorization feature“ within core websocket node and can raise a PR?

---

<div class="post-metadata">

**Author:** ![deltaecho07](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/deltaecho07/32/68244_2.png) [@deltaecho07](https://discourse.nodered.org/u/deltaecho07)\
**Post date:** [27 September 2022 19:42 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/8 "2022-09-27T19:42:09Z")

</div>

I do not agree with you @b0denl0s. You can use my node to connect to a websocket with an authorization header and thereafter you get all the messages sent by the ws-server. If you need to be able to send some commands to the ws-server, let me know.

---

<div class="post-metadata">

**Author:** ![b0denl0s](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/b0denl0s/32/67059_2.png) [@b0denl0s](https://discourse.nodered.org/u/b0denl0s)\
**Post date:** [27 September 2022 21:24 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/9 "2022-09-27T21:24:42Z")

</div>

My understanding @deltaecho07

- I need _ **basic** _ auth -\>\> I understand your solution provides _ **bearer** _ token for auth; as I can see in your code `Authorization: Bearer ` is _hardcoded_ within your initial request header and you append the token string only. For basic `Authorization: Basic ` is required. However, lorenzhoh's library works fine with basic auth. No need to change this part in lorenzhoh's lib.

- But lorenzhoh's implementation has an issue regarding disconnecting/reusing WS connections as I explained [here](https://github.com/LorenzHoh/CustomWebsocket/issues/1) as an issue. You mentioned you updated his library regarding authorization -\>\> I presume that you have re-used these parts of his implementation dealing with disconnecting/reusing ws? If so I do not expect any difference in behavior.

So please let me know what I did not unterstand or presume correctly. 🙂

---

<div class="post-metadata">

**Author:** ![deltaecho07](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/deltaecho07/32/68244_2.png) [@deltaecho07](https://discourse.nodered.org/u/deltaecho07)\
**Post date:** [29 September 2022 15:23 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/10 "2022-09-29T15:23:00Z")

</div>

@b0denl0s sorry I misunderstood you! I thought you also need the Bearer Auth...  
The issue of lorenzhoh's library is that it has a second header attribute which can cause troubles if you leave it blank.

Long story short: you need a library that is capable of connecting to a WS with basic authentication header. Do you need just a subscriber? Or do you want also to send messages to the WS server?

Once I have your answer I will create a new library with the basic Auth header for you. 🙂

---

<div class="post-metadata">

**Author:** ![b0denl0s](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/b0denl0s/32/67059_2.png) [@b0denl0s](https://discourse.nodered.org/u/b0denl0s)\
**Post date:** [5 October 2022 10:54 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/11 "2022-10-05T10:54:44Z")

</div>

> [@deltaecho07](#):
>
> Long story short: you need a library that is capable of connecting to a WS with basic authentication header. Do you need just a subscriber?

Yes, and yes. 🙂

But I would suggest the following: Due to the fact that build in core websocket node is really stable and robust. Would you be able to implement an enhancement to allow header specifications (Bearer token, Basic auth string,…) and do a pull request on these core websocket? I think that will be the best solution, because it is a common and quite central option. That would be great!

---

<div class="post-metadata">

**Author:** ![ebneterc](https://avatars.discourse-cdn.com/v4/letter/e/c2a13f/32.png) [@ebneterc](https://discourse.nodered.org/u/ebneterc)\
**Post date:** [20 November 2022 08:20 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/12 "2022-11-20T08:20:13Z")

</div>

I assume you are using free@home as myself.  
To get the connection working you just need to put in the URL of the websocket the username and password in plaintext. Securitywise this might be a concern, but since you are using a local API and staying withing you network you might dare to do it.

So the URL will look like this: ws://username:password@192.XXX.XX.XX/fhapi/v1/api/ws

After that it works. I used it to listen to one of my pushbuttons. So if the button gets pressed and light is already on, it switches the color of the light to a specified next color in a loop. That way I can switch my colors of the philipps hue with a simple rocker.  
Hope this helps.

---

<div class="post-metadata">

**Author:** ![ericoud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ericoud/32/73343_2.png) [@ericoud](https://discourse.nodered.org/u/ericoud)\
**Post date:** [28 December 2022 11:17 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/13 "2022-12-28T11:17:05Z")

</div>

Hello,  
I try to connect to a websocket server which requires a Basic authentication with node red but it doesn't work. Using Postman with the websocket client authorization it works fine, so I think I miss something in the Node-Red configuration. could you help me?

Here the conf for the Custom websocket subscriber:  
Name: empty  
wss-URL: wss://192.168.203.210:8080/  
X-Client-Id: empty  
Authorization: Basic b3BlcmF0b3I6U2NobmVpZGVyPTE=

the string correspond to the login:password in base64 format.  
It works fine with postman I can connect to the server, here the log:  
Connected to wss://192.168.203.210:8080/  
Handshake Details  
Request URL: [https://192.168.203.210:8080/](https://192.168.203.210:8080/)  
Request Method: GET  
Status Code: 101 Switching Protocols  
Request Headers  
Sec-WebSocket-Version: 13  
Sec-WebSocket-Key: NRVvndm0vfoQ7oT1DGmasA==  
Connection: Upgrade  
Upgrade: websocket  
Authorization: Basic b3BlcmF0b3I6U2NobmVpZGVyPTE=  
Sec-WebSocket-Extensions: permessage-deflate; client\_max\_window\_bits  
Host: 192.168.203.210:8080

With Node-Red I have always the message: "Could not connect to server"

Regards,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [26 February 2023 11:17 UTC](https://discourse.nodered.org/t/how-to-enhance-websocket-in-with-basic-authorization-header/67199/14 "2023-02-26T11:17:46Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.