Intercept request for security

[furesoft]

Is it possible to intercept rpc request to deny request eg. a certain user is sending the request?
And is it possible to send some metadata like a token?

[AArnott]

The JSON-RPC spec assumes a duplex stream where many messages can be passed back and forth. It doesn't define headers. So auth isn't part of the spec, nor is there much room to imagine adding it.

But since you're presumably talking to the same remote party for every message within a connection, that makes it easy: just authenticate them before starting the JSON-RPC connection. How you do this may vary by the underlying transport. For example if you're using HTTPS and you upgrade to a websocket for JSON-RPC communication, you can authenticate using standard HTTPS headers before the upgrade.

Once you know who you're talking to, you can make authorization decisions within the JSON-RPC realm. For example, you can use different RPC target objects based on who the remote party is so they have access to a larger or smaller set of methods. Or you can store the remote party's identity in your JSON-RPC target object so that RPC methods themselves can make authorization decisions.