title: What are the possible ways to authenticate user when websocket connection is used?
body: <p>Example scenario: Web based multi-user chat application through websocket connection. How can I ensure (or guarantee) that each connection in this application belongs to certain authenticated user and "can't be" exploited by false user impersonation or intervene during the connection.</p>
  
  <p>by the way I am using tornado websocket on server side to implement basic chat room and already doing authentication for the non-websocket part of my app.</p>
  
  <p>ps : suppose authenticated user posts what he wants and when other user open the listing page of item and automatically other user is added to list of websocket listeners what I want each user able to chat with buyer of the item individually not in a chatroom way but with one to one chat</p>