Is it secure to authenticate web socket connections using jwt?

tl;dr - yes, you can use JWT for web socket connections if you keep certain regulations in mind

Let's first summarize what a JSON Web Token ( JWT) is. A JWTconsists of three parts: Header , Payload and Signature .

• The header contains the type of token and signature algorithm, ie, HS256 or RSA. The header is Base64Url encoded.

• The payload contains the claims and can also include custom data like the user ID from the database. The payload is well Base64Url encoded.

• The signature (the last part of the token) is created out of the signed header , in the payload , and Secretknown only to itself, using the specified algorithm.

So knowing this, we can say that the content of the token (headers and payload) is not secure and therefore should not contain sensitive data. However, the fact that the token is only signed secretwith what you know (your server) makes it very secure, for its purpose. Because even if the tokens are used from the client, only you can issue those tokens, and only you can create valid tokens. You can't simply forge a token that can be used in your api. Someone can still steal the token on the client side, but it's to your advantage to keep the token's expiry time short.

Authenticating websocket connections using JWT

As long as you don't use long lived tokens, or even infinitely valid tokens (expiration time), I'd say this is a solid solution. Typically JWTs are used in a REST API environment, so the user first authorizes using an authentication endpoint (such as username and password) and then distributes a valid JWT.

I would suggest to also establish a network socket connection (socket.io in your case). Like this (of course it depends on your backend):

// client

const axios = require('axios');
const io = require('socket.io-client');

const { token } = await axios.post('/auth/login', credentials);

const socket = io("ws://example.com/", {
  auth: {
    token: "123"
  }
});

// server
// socket.io middleware

io.use((socket, next) => {
  const token = socket.handshake.auth.token;
  // ... check token or whatever
});