# Websocket Validation

**URL:** <https://www.ruby-forum.com/t/websocket-validation/244640>\
**Category:** NGINX\
**Created:** [May 17, 2016, 7:33pm UTC](https://www.ruby-forum.com/t/websocket-validation/244640 "2016-05-17T19:33:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [May 17, 2016, 7:33pm UTC](https://www.ruby-forum.com/t/websocket-validation/244640/1 "2016-05-17T19:33:44Z")

</div>

Hello,

I use nginx as a proxy, and establish a webscoket between client and  
backend.I validate user’s cookies before establish WS and when WS is in  
use I validate cookies on backend periodically.

With this set up in place when a user’s cookie expires , an  
established  
WS will remain in use until next validation check on backend happens.

How I can fix this?

Thanks,  
Vikrant

---

<div class="post-metadata">

**Author:** ![vikrant\_singh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/c57346/32.png) [@vikrant\_singh](https://www.ruby-forum.com/u/vikrant_singh)\
**Post date:** [May 17, 2016, 8:56pm UTC](https://www.ruby-forum.com/t/websocket-validation/244640/2 "2016-05-17T20:56:06Z")

</div>

On Tue, May 17, 2016 at 10:33:24AM -0700, vikrant singh wrote:

Hi there,

> I use nginx as a proxy, and establish a webscoket between client and  
> backend.I validate user’s cookies before establish WS and when WS is in  
> use I validate cookies on backend periodically.
> 
> With this set up in place when a user’s cookie expires , an established  
> WS will remain in use until next validation check on backend happens.

The nginx model is more or less: establish the websocket connection and  
treat it as an opaque tunnel.

> How I can fix this?

Once the connection is established, you do your own control.

Possibly doing the backend validation check more frequently will help?  
Or  
whatever it is that decides that the cookie has expired, could let the  
backend know to close the connection now (or could invite the backend  
to do a validation check now)?

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)