Authentication

As of now Colyseus does not have any authentication step in built, so Marie can be Marie but is actually Jake! Lets make sure that Jake can’t be Marie.

My proposal is as follows and assumes TLS

• Upon initial connection the server sends a request_authorization event. Which has a nonce and a state.
• Upon receiving the request_authorization the client fetches a JWT using an IdP and sends this JWT back authorization as the first event with the payload as a JWT.
• The server validates the token
  • If the token is invalid or nonce/state failure occurs the server emits an authorization_error event and must close the connection immediately.
  • If the token is valid the server sends authenticated event and continues to initialize the client.

This will work just fine with #48 in future as any transport mechanism can implement this as the primary means of upgrading the connection.

The Token structure is tbd we need to consider what the user will be able to do (privileged access, etc, before we find the optimal token structure)

This flow does not account for IdP initiated flow. However, the match-making can still be moved to the identity provider which will resolve #43

[darkyen]

LGTM

[endel]

Finally an initial implementation of this! https://github.com/gamestdio/colyseus/wiki/Authentication

Feel free to re-open if you feel something is missing. Thanks, @darkyen!