Websockets Auth

[agieocean]

Was wondering if the auth decorator works for websocket handlers so like:

@app.route('/echo')
@with_websocket
@auth
def echo(request, ws):
    ...

[miguelgrinberg]

Yes, that should work. I would put the auth decorator above the websocket one, though, so that the credentials are checked before the websocket handshake. Also keep in mind that on the browser the WebSocket API does not include the option to send custom headers, so not counting hacks that attempt to overcome this big limitation your only option is to use basic auth.