Preview Spring Security WebSocket Support
[callout title=Updated Dec 11 2014]Although originally about Spring Security 4.0.0.M2, the blog has been updated to reflect improvements found in Spring Security 4.0 RC1.[/callout]
Introduction
Previously, an application could use Spring Security to perform authentication in a WebSocket application. This worked because the Principal
of an HttpServletRequest
will be propagated to the WebSocket Session.
The problem is that authorization was limited to handshake. This means that once the connection was made, there was no way to provide any granularity to authorization of the WebSocket application…