Skip to content

Guided tour

FabrCore 2.0 · Release and package availability

These guides track the current 2.0 source. Stable 2.0.0 publication is pending; package commands show the release target. Until it is published, follow the source quick start or use a matching available prerelease set. Release migration · Runtime modes

MODULE 05 · LESSON 5.2

Configure the Host endpoint and authenticate the connection

Authenticate the mobile connection with a short-lived WebSocket ticket.

Lesson 22 of 86 · FabrCore 2.0

Overview

A ticket carries the authenticated principal into the WebSocket session without placing a bearer token in a URL. The first hello binds the stable client ID and optional checkpoint. The Host overwrites caller-controlled sender identity; legacy query/header identity selection is not the v2 protocol.

The ticket bridges HTTP identity into WebSocket

First authenticate an HTTP client through your application's supported login. Use that client to obtain the WebSocket ticket. The ticket proves the principal for the socket handshake without exposing a long-lived bearer token in the URL. The subsequent hello identifies the stable client and its optional delivery checkpoint. These are different pieces of the connection process.

Origin checks and identity solve different problems

An allowed browser origin restricts which browser pages may open the connection. It does not log the user in. Conversely, an authenticated mobile app still needs the correct endpoint and transport settings. The Host's v2 protocol establishes sender identity from authenticated context rather than trusting a user-chosen principal in a query string.

Authenticate and open the socket

Download the Operations Desk source. The README lists project setup, package prerequisites and local ports.

  1. Configure the Host authentication middleware and authenticate the HttpClient used for POST /fabrcoreapi/ws/ticket. Use a public-client sign-in flow on mobile; never embed an admin key or client secret.
  2. Configure allowed browser origins where browsers connect. Headless/native clients may omit Origin. Keep AllowDevelopmentPrincipalSelection disabled outside workstation development.
  3. Allow WebSocket upgrades through the reverse proxy, use trusted TLS and configure idle timeouts. The typed client obtains the ticket and offers fabrcore.v2 plus the ticket subprotocol.
Host appsettings.json · browser origin and transport policy 
{
  "FabrCore": {
    "Host": { "AllowedWebSocketOrigins": ["https://app.example.com"] },
    "WebSocket": {
      "TicketLifetime": "00:00:30",
      "RequestTimeout": "00:05:00",
      "AllowDevelopmentPrincipalSelection": false
    }
  }
}

Observe success and rejection separately

  1. Open a socket using an authenticated HTTP client, ticket and hello flow. Expect the typed client to reach its connected state for the intended principal and stable client ID.
  2. Repeat without valid authentication in a test. The ticket/connection must fail rather than accepting a caller-supplied user handle.
  3. For a browser client, try an origin outside the configured allowlist. Inspect the transport rejection separately from an authentication error; changing a model setting cannot fix either one.

A connected state establishes transport and identity. It does not yet prove that an agent was provisioned or that a sent message produced a final response.

If the result is different

Do not bypass certificate validation to make Android networking work. Provision a trusted development certificate/endpoint and verify the token audience.

Go deeper

Explore the related documentation.