WebSocket authentication/Security in Node-RED on Bluemix
We have Node-RED application server, which defines end points for both HTTP and Web socket connections.
IOS and NAO robot are the clients who connect to Node-RED. Clients can connect to bluemix by using both WS and WSS.
How to stop WS connections and allow only WSS in bluemix ?
Regarding the webSocket authentication, web socket protocol does not define header details. What are the possible ways in Node-RED ?
Token based security is the alternative to resolve this issue. I have added
node-red-contrib-authnpm to Node-RED and with that able to use the JsonWebToken node. JsonWebToken response provides token. Please let me know how to use token validation in Node-RED. (I only know the Node.js sample, http://iostreamer.me/ws/node.js/jwt/2016/05/08/websockets_authentication.html ) . Note : Think about the IOS and NAO-robot client is able to support.
For your question 3, Liberty can be configured to accept JsonWebToken (JWT) as authentication token, see http://www.ibm.com/support/knowledgecenter/SSD28V_9.0.0/com.ibm.websphere.wlp.core.doc/ae/twlp_sec_config_oidc_jwt.html
With question 3. Yes. Java and Node.js clients can set headers.
In node.js client,
var options = {headers : { "token": "12"} };
ws = new WebSocket('wss://BluemixHost/wsTest1', options);
My issue is that headers are not visible in Node-RED web socket in node. How to view those headers and validate those in Node-RED ?
@RuchiraKariyawasam, in case you do not get any further responses, consider asking your question again, based on what you now know. When a subject-matter expert sees that a question has been answered, they are less likely to give it attention.
Follow-up question posted on Stack Overflow: http://stackoverflow.com/questions/41720123/disable-unsecure-websocket-calls-for-node-red-on-ibm-bluemix
Yes. you have shared the stackoverflow question raised by me. I will ask rest of questions one by one as you said. Thank you.
@RalphEarle : Anyway is that the approach we need to follow on IBM developer forum. It is opposite of stackoverflow since it is duplicate questions.