Api Authentication via QueryString?

[ComputerElite]

Would it be possible to authenticate on WebSockets by passing an ApiToken via query strings to the websocket url? The current WebSocket api in javascript doesn't allow for setting custom headers (https://stackoverflow.com/a/4361358) and thus making authentication impossible without a proxy.

Example: wss://api.openshock.app/1/hubs/user?OpenShockToken=<token>

[LucHeart]

I only have some concerns regarding security here, could implement a way to authenticate by sending a authentication message as the first message, would mean some reworks in the websocket controller base.

[ComputerElite]

The authentication message would also work for me