How do I authenticate a WebSocket from a browser if I cannot set headers?

The browser constructor only takes a URL, so the usual options are a session cookie, a short-lived token in the query string, or a first-message auth exchange right after connecting. Cookies flow automatically but WebSocket ignores CORS, so verify the Origin header server-side to block cross-site connections. Whichever you choose, decide how to evict a connection whose session gets revoked hours after the handshake.

How many WebSocket connections can one server handle?

Tens to hundreds of thousands on a tuned box, budgeting a few tens of kilobytes of memory per idle connection, with WhatsApp's 2 million per server as the famous upper bound. The defaults get in the way long before the hardware does: file descriptor limits, framework connection caps, and load balancer ceilings. In practice the binding constraint is usually fan-out and deploy handling, not raw connection count.

Should I use WebSocket or SSE for my feature?

Count the messages the client sends. If the answer is rarely or never, SSE plus ordinary POSTs is less code, easier infrastructure, and comes with built-in reconnection. WebSocket earns its keep when the client sends frequently, needs binary frames, or the feature needs sustained sub-100 ms bidirectional traffic like collaborative cursors or gameplay.

Real-Timechapter 4 of 4 · 4 lessons

WebSocket

Full-duplex persistent connection, both sides send messages freely after a single handshake.

← All chapters View in cheatsheet

Two people edit the same document. Each keystroke, each cursor move, has to reach the other within about 50 milliseconds or the experience falls apart.

That is twenty messages a second in each direction, both ways at once. Wrapped in ordinary HTTP requests, every one of those messages carries a few hundred bytes of headers to deliver a few bytes of payload, and pays for a round trip to say it.

WebSocket drops the request and response rhythm for a raw two-way pipe. One handshake, then either side sends whenever it likes, for hours, with a header of a couple of bytes.

It is the heavyweight of this course and the one teams reach for first and regret most, because everything HTTP was quietly doing for you is now yours to build.

Lessons

4 in this chapter

The Upgrade HandshakeOne HTTP request, a 101 response, and then HTTP is over for the life of the connection.3 min
Full Duplex MessagingFrames are cheap and unstructured, so the message protocol becomes your job.2 min
Scaling WebSocket FleetsThe connection is the state, so scaling is routing, memory, and surviving your own deploys.2 min
When Not to Use ItMost features that ask for WebSocket are polling or SSE workloads wearing a costume.2 min