[FEATURE] APIKeyHeader for Websockets

• I used the GitHub search to find a similar issue and didn’t find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google “How to X in FastAPI” and didn’t find any information.

Is your feature request related to a problem

Yes. It would be nice to use Security with APIKeyHeader (maybe APIKeyCookie, APIKeyQuery as well) for websocket connections.

The solution you would like

Consistent with the current http way of doing it

api_key_header = APIKeyHeader(name=API_KEY_NAME)

async def get_origin(
        api_key: str = Security(api_key_header),
        db: AsyncIOMotorClient = Depends(get_database), ):

Describe alternatives you’ve considered

At the moment we plan to protect websocket endpoints with a simple api_key: str = Header(None), and then we do

if not api_key:
        await websocket.close(code=WS_1008_POLICY_VIOLATION)
        return None

For this I guess we might need the WebSocketException feature in Starlette

If someone can give me some guiding on how to structure this feature I might give it a try and do a PR

[tiangolo]

Yes, you can, it’s documented here: https://fastapi.tiangolo.com/advanced/websockets/#using-depends-and-others

Also, have in mind that browsers don’t have a way to set headers when creating WebSocket connections: https://stackoverflow.com/a/4361358/219530

[phy25]

@Catastropha APIKeyHeader requires Request which is not available in WebSocket. I guess you can just implement your own Security object for your use case.

https://github.com/tiangolo/fastapi/blob/9c3c9b6e78768374868d690bc05918d58481e880/fastapi/security/api_key.py#L38