How does the Netty4 WebSocket server correctly return a 401 status code during the handshake phase for the browser to recognize?

How Netty4 WebSocket Server Elegantly Handles Unauthorized Connections (401 Status Code)

Security verification is crucial when building a WebSocket server using Netty. This article discusses how to correctly handle the failure of token verification and ensure that the browser can recognize the 401 unauthorized status code returned by the server, thereby improving user experience and debugging efficiency.

Problem: During the WebSocket handshake phase, if the token verification fails, the server returns the 401 status code and closes the connection, but the browser cannot perceive the specific cause of the error.

The problem with the original code is that the returned 401 response body is empty and the necessary HTTP header information is missing, which causes the browser to be unable to parse the response correctly.

Improved solution: When returning a 401 response, you need to include a descriptive error message and complete HTTP header information.

Improved server code:

 private void httpResponse401(ChannelHandlerContext ctx, FullHttpRequest request) {
    FullHttpResponse response = new DefaultFullHttpResponse(
            request.protocolVersion(),
            HttpResponseStatus.UNAUTHORIZED,
            Unpooled.copiedBuffer("Unauthorized: Invalid token", CharsetUtil.UTF_8)
    );
    response.headers().set(HttpHeaderNames.CONTENT_TYPE, "text/plain; charset=UTF-8");
    response.headers().set(HttpHeaderNames.CONTENT_LENGTH, response.content().readableBytes());
    ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
    ReferenceCountUtil.release(request);
}

Key Improvements:

• Added error message: Unpooled.copiedBuffer("Unauthorized: Invalid token", CharsetUtil.UTF_8) adds clear error messages to the response body, which facilitates the browser and developers to understand the cause of the error.
• Set the CONTENT_TYPE header: response.headers().set(HttpHeaderNames.CONTENT_TYPE, "text/plain; charset=UTF-8") specifies that the response content type is plain text and specifies that the character set is UTF-8 to ensure that the browser can correctly decode the error message.
• Set the CONTENT_LENGTH header: response.headers().set(HttpHeaderNames.CONTENT_LENGTH, response.content().readableBytes()) accurately informs the browser of the response body length to avoid parsing errors.

Through these improvements, the browser will receive an HTTP response containing 401 status code and error message when the connection fails, so that specific error messages can be displayed in the developer tools, which facilitates developers to debug and troubleshoot problems, and improve user experience and development efficiency. This ensures that error handling during the WebSocket handshake phase is more robust and reliable.

The above is the detailed content of How does the Netty4 WebSocket server correctly return a 401 status code during the handshake phase for the browser to recognize?. For more information, please follow other related articles on the PHP Chinese website!