WIP

dWeb/Web.cpp

@@ -187,13 +187,30 @@ void HandleHTTPMessage(mg_connection* connection, const mg_http_message* http_ms
 			
 			bool authenticated = isInternal; // Internal connections are automatically trusted
 			
-			// For external connections, require authentication cookie
+			// For external connections, require authentication cookie and valid JWT
 			if (!isInternal) {
 				const auto* cookieHeader = mg_http_get_header(const_cast<mg_http_message*>(http_msg), "Cookie");
 				if (cookieHeader) {
 					std::string cookieStr = std::string(cookieHeader->buf, cookieHeader->len);
-					if (!cookieStr.empty() && cookieStr.find("dashboardToken=") != std::string::npos) {
-						authenticated = true;
+					
+					// Extract token from cookie
+					const std::string tokenPrefix = "dashboardToken=";
+					const size_t tokenPos = cookieStr.find(tokenPrefix);
+					
+					if (tokenPos != std::string::npos) {
+						size_t valueStart = tokenPos + tokenPrefix.length();
+						size_t valueEnd = cookieStr.find(";", valueStart);
+						
+						if (valueEnd == std::string::npos) {
+							valueEnd = cookieStr.length();
+						}
+						
+						std::string token = cookieStr.substr(valueStart, valueEnd - valueStart);
+						
+						// Use authentication callback if available
+						if (Game::web.GetWSAuthCallback()) {
+							authenticated = Game::web.GetWSAuthCallback()(token);
+						}
 					}
 				}
 			}

dWeb/Web.h

@@ -70,6 +70,10 @@ enum SubscriptionStatus {
 	SUBSCRIBED = 1
 };
 
+// WebSocket authentication callback function type
+// Returns true if token is valid, false otherwise
+using WSAuthCallback = std::function<bool(const std::string&)>;
+
 class Web {
 public:
 	// Constructor
@@ -89,17 +93,23 @@ public:
 	void RegisterWSSubscription(const std::string& subscription);
 	// Add global middleware that applies to all routes
 	void AddGlobalMiddleware(MiddlewarePtr middleware);
+	// Set WebSocket authentication callback for token validation
+	void SetWSAuthCallback(WSAuthCallback callback) { wsAuthCallback = callback; }
 	// Returns if the web server is enabled
 	bool IsEnabled() const { return enabled; };
 	// Send a message to all connected WebSocket clients that are subscribed to the given topic
 	void static SendWSMessage(std::string sub, nlohmann::json& message);
 	// Get mongoose manager for direct access
 	mg_mgr& GetManager() { return mgr; };
+	// Get WebSocket auth callback (used during WebSocket upgrade)
+	WSAuthCallback GetWSAuthCallback() const { return wsAuthCallback; }
 private:
 	// mongoose manager
 	mg_mgr mgr;
 	// If the web server is enabled
 	bool enabled = false;
+	// WebSocket authentication callback
+	WSAuthCallback wsAuthCallback = nullptr;
 };
 
 #endif // !__WEB_H__