regarding client authentication

[GoliardWan]

Hi,

I build a apache+mod_pywebsocket environment just now. I'm a beginner
in websocket server development, I was wondering if I can use
something like "session" in C# in order to guarantee that each
connection in this application belongs to certain authenticated user
and "can't be" exploited by false user impersonation during the
connection? In other words, how could I implement login issue in
websocket server?

Thanks

[Takeshi Yoshino]

I don't know much about ASP.NET's session, but you can use cookie on WebSocket as well as HTTP http://tools.ietf.org/html/rfc6265 to manage state between connections..

If your server passes some session token as a cookie to a browser, the browser sends it in WebSocket handshake to your server on the next visit.

Takeshi

[GoliardWan]

Many thanks for your solutions. I will find out how to save and check cookie's id with client using python code on server. 

2011/9/7 Takeshi Yoshino <tyos...@chromium.org>