starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #4974] Add support that API-Keys authenticate sockets #4390

New Issue
Open
opened 2026-04-25 00:19:34 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:19:34 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/4974
Author: @Vito0912
Created: 1/9/2026
Status: 🔄 Open

Base: master ← Head: feat/addAPISocket

📝 Commits (1)

  • dfce15a Add support that API-Keys authenticate sockets

📊 Changes

2 files changed (+44 additions, -9 deletions)

View changed files

📝 server/SocketAuthority.js (+44 -8)
📝 server/auth/TokenManager.js (+0 -1)

📄 Description

Brief summary

This pull request adds support for authenticating WebSocket connections using API keys in addition to the JWT-based authentication. The main logic was "inspired :)" by the already existing code in the TokenManager.js.

Which issue is fixed?

None, but "fixes" TODO and fixes a user complaint about my autoconverter, which is based on websockets and could not use API keys

In-depth Description

Adds the same mechanisms and fallback the current jwtAuthCheck already has. I copied over the comments and the main "logic" behind it. This also allows using websockets with the API Keys which currently end up in an unauthenticated state.
I also added the expiration to the websocket emit, but realisticly it will not do that much as it would get invalidated by the http request. But just to make sure if a user only uses the key for websockets this would be prevented now too. To my knowledge there is nothing one could to over websockets that affects anything, but in theory one token would never be set to inactive if I understand the code correctly

How have you tested this?

Used the websocket example as testing. Works now with the API token

Screenshots

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/4974 **Author:** [@Vito0912](https://github.com/Vito0912) **Created:** 1/9/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `feat/addAPISocket` --- ### 📝 Commits (1) - [`dfce15a`](https://github.com/advplyr/audiobookshelf/commit/dfce15a74c3837fe1a0c0acb1f50cce6cb59a812) Add support that API-Keys authenticate sockets ### 📊 Changes **2 files changed** (+44 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `server/SocketAuthority.js` (+44 -8) 📝 `server/auth/TokenManager.js` (+0 -1) </details> ### 📄 Description <!-- For Work In Progress Pull Requests, please use the Draft PR feature, see https://github.blog/2019-02-14-introducing-draft-pull-requests/ for further details. If you do not follow this template, the PR may be closed without review. Please ensure all checks pass. If you are a new contributor, the workflows will need to be manually approved before they run. --> ## Brief summary This pull request adds support for authenticating WebSocket connections using API keys in addition to the JWT-based authentication. The main logic was "inspired :)" by the already existing code in the `TokenManager.js`. ## Which issue is fixed? None, but "fixes" TODO and fixes a user complaint about my autoconverter, which is based on websockets and could not use API keys ## In-depth Description Adds the same mechanisms and fallback the current jwtAuthCheck already has. I copied over the comments and the main "logic" behind it. This also allows using websockets with the API Keys which currently end up in an unauthenticated state. I also added the expiration to the websocket emit, but realisticly it will not do that much as it would get invalidated by the http request. But just to make sure if a user only uses the key for websockets this would be prevented now too. To my knowledge there is nothing one could to over websockets that affects anything, but in theory one token would never be set to inactive if I understand the code correctly ## How have you tested this? Used the websocket example as testing. Works now with the API token ## Screenshots <!-- If your PR includes any changes to the web client, please include screenshots or a short video from before and after your changes. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:19:34 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#4390
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?