Accessing websocket headers in Streamlit 1.12.0

Problem

In previous versions, we used the following code to retrieve the access token header from the websocket headers:

from streamlit.server.server import Server
from streamlit.scriptrunner.script_run_context import get_script_run_ctx

def get_access_token() -> Optional[str]:
    """Gets the access token from the websocket headers, if possible."""
    # Get headers
    session_id = get_script_run_ctx().session_id  # type: ignore
    server = Server.get_current()
    session_info = server._get_session_info(session_id)
    if session_info.ws is None:  # type: ignore
        # At first page load, this is None (at least until #4099 is fixed)
        st.markdown("Unable to get session websocket. Please refresh the page.")
        st.stop()
    headers = session_info.ws.request.headers  # type: ignore

    # Get access token
    access_token_key = "X-Access-Token"
    if access_token_key in headers.keys():
        access_token = headers[access_token_key]
    else:  # development environment
        access_token = None

    return access_token

We noticed the import paths changed for scriptrunner and server, however Server.get_current() apparently no longer exists. Is there still a way for us to get the websocket headers?

This is very important for us, as we use the access token for group-based access control and there isn’t another way for us to easily get the same information that we’ve been able to find.

Currently we’ve just pinned the version to 1.11.1 but that’s not great long-term as we do like to take advantage of new features as they come out.

Solution

MVP: Whatever is easiest for us to be able to get the access token from the websocket headers.

Possible additions: Potentially some documentation support for the server side of the app would be great.

[tconkling]

Hey all, thanks for the comments! Yeah, so normally we advise against using internal Streamlit APIs because we don’t support them and they can change or go away with no notice. (In this case, the Server singleton was a casualty of a major refactor we made to the internals of Streamlit.)

But! I totally get this ask; “access websocket headers” is something that was implicitly possible in Streamlit < 1.12, and no longer is. The best long-term solution to something like this is “provide a public - and therefore supported - streamlit API to do the thing”. Ultimately that’s a product decision, but I don’t want to pass the buck entirely - I’ll bring this up with the product team, pitch the use case to them, and see what our options are. (And maybe the best near-term option will be “just add the hacky singleton back in”.)

I probably won’t have any news on this until end of next week at the earliest, but I’ll follow up when there’s something to share!

[nicornk]

@tconkling Highly appreciate the update. What about making this an officially supported public API? As you can see from the replies to the issues, the community has a clear demand for this.