DWilliams Posted August 16, 2012 Share Posted August 16, 2012 I'm developing an application that consists of several parts. The main website is written in PHP, but there are also several WebSocket servers that the user might need to connect to. The servers are written in C# and have no direct communication with the web server other than via sharing the same database. Where should I start reading to come up with a way to have website logins also authenticate the user on the WebSocket servers? Since the WebSocket connections are all done in client-side JS, nothing it does can be trusted. For example, if I have a WebSocket chat server, I don't want the connecting users to have to re-login but I also don't want to rely on the JavaScript to, for example, say "Hey, my name is Fred". I'd rather have the web server somehow tell the chat server "Yep, he's logged in as Fred, all is good". Quote Link to comment https://forums.phpfreaks.com/topic/267172-authenticating-a-user-between-multiple-servers/ Share on other sites More sharing options...
Christian F. Posted August 16, 2012 Share Posted August 16, 2012 Why not just use the session data from the web server? Since you're already relying upon it to be secure, and the user need to send a cookie to identify the session he's using, you already have all the pieces you need. Quote Link to comment https://forums.phpfreaks.com/topic/267172-authenticating-a-user-between-multiple-servers/#findComment-1369887 Share on other sites More sharing options...
xyph Posted August 16, 2012 Share Posted August 16, 2012 I'm developing an application that consists of several parts. The main website is written in PHP, but there are also several WebSocket servers that the user might need to connect to. The servers are written in C# and have no direct communication with the web server other than via sharing the same database. Where should I start reading to come up with a way to have website logins also authenticate the user on the WebSocket servers? Since the WebSocket connections are all done in client-side JS, nothing it does can be trusted. For example, if I have a WebSocket chat server, I don't want the connecting users to have to re-login but I also don't want to rely on the JavaScript to, for example, say "Hey, my name is Fred". I'd rather have the web server somehow tell the chat server "Yep, he's logged in as Fred, all is good". Each request is independent of the last. The client has to send some sort of authorization token (session token) to the server, which can then verify it's legit with the database. Quote Link to comment https://forums.phpfreaks.com/topic/267172-authenticating-a-user-between-multiple-servers/#findComment-1369898 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.