aws-appsync-subscription-link 4.0.1 → 4.0.2

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+<a name="4.0.2"></a>
+## [4.0.2](https://github.com/awslabs/aws-mobile-appsync-sdk-js/compare/aws-appsync-subscription-link@4.0.1...aws-appsync-subscription-link@4.0.2) (2026-03-19)
+
+
+### Bug Fixes
+
+* **subscription-link:** move auth credentials from URL query string to Sec-WebSocket-Protocol header ([fb5dd3e](https://github.com/awslabs/aws-mobile-appsync-sdk-js/commit/fb5dd3e))
+
+
+
+
 <a name="4.1.0"></a>
 # [4.1.0] (Unreleased)
 

package/__tests__/link/realtime-subscription-handshake-link-test.ts

@@ -69,6 +69,20 @@ class myWebSocket implements WebSocket {
   }
 }
 
+/**
+ * Helper to decode a base64url-encoded header from the Sec-WebSocket-Protocol value.
+ * The protocol value is prefixed with "header-".
+ */
+function decodeProtocolHeader(protocols: string | string[]): Record<string, string> {
+  const arr = Array.isArray(protocols) ? protocols : [protocols];
+  const headerProtocol = arr.find(p => p.startsWith("header-"));
+  if (!headerProtocol) throw new Error("No header- protocol found");
+  const base64url = headerProtocol.slice("header-".length);
+  // Convert base64url back to standard base64
+  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+  return JSON.parse(Buffer.from(base64, "base64").toString());
+}
+
 describe("RealTime subscription link", () => {
   test("Can instantiate link", () => {
     expect.assertions(1);
@@ -99,7 +113,7 @@ describe("RealTime subscription link", () => {
   });
 
   test("Initialize WebSocket correctly for API KEY", (done) => {
-    expect.assertions(2);
+    expect.assertions(3);
     jest.spyOn(Date.prototype, "toISOString").mockImplementation(
       jest.fn(() => {
         return "2019-11-13T18:47:04.733Z";
@@ -107,10 +121,14 @@ describe("RealTime subscription link", () => {
     );
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
+        // URL should be clean — no query string with credentials
         expect(url).toBe(
-          "wss://apikeytesturl1234567890123.appsync-realtime-api.us-west-2.amazonaws.com/graphql?header=eyJob3N0IjoiYXBpa2V5dGVzdHVybDEyMzQ1Njc4OTAxMjMuYXBwc3luYy1hcGkudXMtd2VzdC0yLmFtYXpvbmF3cy5jb20iLCJ4LWFtei1kYXRlIjoiMjAxOTExMTNUMTg0NzA0WiIsIngtYXBpLWtleSI6Inh4eHh4In0=&payload=e30="
+          "wss://apikeytesturl1234567890123.appsync-realtime-api.us-west-2.amazonaws.com/graphql"
         );
-        expect(protocol).toBe("graphql-ws");
+        // Protocol should be an array with graphql-ws and header- prefix
+        expect(Array.isArray(protocol)).toBe(true);
+        const header = decodeProtocolHeader(protocol);
+        expect(header["x-api-key"]).toBe("xxxxx");
         done();
         return new myWebSocket();
       }
@@ -141,7 +159,7 @@ describe("RealTime subscription link", () => {
   });
 
   test("Initialize WebSocket correctly for API KEY with custom domain", (done) => {
-    expect.assertions(2);
+    expect.assertions(3);
     jest.spyOn(Date.prototype, "toISOString").mockImplementation(
       jest.fn(() => {
         return "2019-11-13T18:47:04.733Z";
@@ -150,9 +168,11 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://apikeytest.testcustomdomain.com/graphql/realtime?header=eyJob3N0IjoiYXBpa2V5dGVzdC50ZXN0Y3VzdG9tZG9tYWluLmNvbSIsIngtYW16LWRhdGUiOiIyMDE5MTExM1QxODQ3MDRaIiwieC1hcGkta2V5IjoieHh4eHgifQ==&payload=e30="
+          "wss://apikeytest.testcustomdomain.com/graphql/realtime"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
+        const header = decodeProtocolHeader(protocol);
+        expect(header["x-api-key"]).toBe("xxxxx");
         done();
         return new myWebSocket();
       }
@@ -183,7 +203,7 @@ describe("RealTime subscription link", () => {
   });
 
   test("Initialize WebSocket correctly for COGNITO USER POOLS", (done) => {
-    expect.assertions(2);
+    expect.assertions(3);
     jest.spyOn(Date.prototype, "toISOString").mockImplementation(
       jest.fn(() => {
         return "2019-11-13T18:47:04.733Z";
@@ -192,9 +212,11 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://cognitouserpooltesturl1234.appsync-realtime-api.us-west-2.amazonaws.com/graphql?header=eyJBdXRob3JpemF0aW9uIjoidG9rZW4iLCJob3N0IjoiY29nbml0b3VzZXJwb29sdGVzdHVybDEyMzQuYXBwc3luYy1hcGkudXMtd2VzdC0yLmFtYXpvbmF3cy5jb20ifQ==&payload=e30="
+          "wss://cognitouserpooltesturl1234.appsync-realtime-api.us-west-2.amazonaws.com/graphql"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
+        const header = decodeProtocolHeader(protocol);
+        expect(header["Authorization"]).toBe("token");
         done();
         return new myWebSocket();
       }
@@ -225,7 +247,7 @@ describe("RealTime subscription link", () => {
   });
 
   test("Initialize WebSocket correctly for COGNITO USER POOLS with custom domain", (done) => {
-    expect.assertions(2);
+    expect.assertions(3);
     jest.spyOn(Date.prototype, "toISOString").mockImplementation(
       jest.fn(() => {
         return "2019-11-13T18:47:04.733Z";
@@ -234,9 +256,11 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://cognitouserpools.testcustomdomain.com/graphql/realtime?header=eyJBdXRob3JpemF0aW9uIjoidG9rZW4iLCJob3N0IjoiY29nbml0b3VzZXJwb29scy50ZXN0Y3VzdG9tZG9tYWluLmNvbSJ9&payload=e30="
+          "wss://cognitouserpools.testcustomdomain.com/graphql/realtime"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
+        const header = decodeProtocolHeader(protocol);
+        expect(header["Authorization"]).toBe("token");
         done();
         return new myWebSocket();
       }
@@ -267,7 +291,7 @@ describe("RealTime subscription link", () => {
   });
 
   test("Initialize WebSocket correctly for OPENID_CONNECT", (done) => {
-    expect.assertions(2);
+    expect.assertions(3);
     jest.spyOn(Date.prototype, "toISOString").mockImplementation(
       jest.fn(() => {
         return "2019-11-13T18:47:04.733Z";
@@ -276,9 +300,11 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://openidconnecttesturl123456.appsync-realtime-api.us-west-2.amazonaws.com/graphql?header=eyJBdXRob3JpemF0aW9uIjoidG9rZW4iLCJob3N0Ijoib3BlbmlkY29ubmVjdHRlc3R1cmwxMjM0NTYuYXBwc3luYy1hcGkudXMtd2VzdC0yLmFtYXpvbmF3cy5jb20ifQ==&payload=e30="
+          "wss://openidconnecttesturl123456.appsync-realtime-api.us-west-2.amazonaws.com/graphql"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
+        const header = decodeProtocolHeader(protocol);
+        expect(header["Authorization"]).toBe("token");
         done();
         return new myWebSocket();
       }
@@ -309,7 +335,7 @@ describe("RealTime subscription link", () => {
   });
 
   test("Initialize WebSocket correctly for OPENID_CONNECT with custom domain", (done) => {
-    expect.assertions(2);
+    expect.assertions(3);
     jest.spyOn(Date.prototype, "toISOString").mockImplementation(
       jest.fn(() => {
         return "2019-11-13T18:47:04.733Z";
@@ -318,9 +344,11 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://openidconnecttesturl.testcustomdomain.com/graphql/realtime?header=eyJBdXRob3JpemF0aW9uIjoidG9rZW4iLCJob3N0Ijoib3BlbmlkY29ubmVjdHRlc3R1cmwudGVzdGN1c3RvbWRvbWFpbi5jb20ifQ==&payload=e30="
+          "wss://openidconnecttesturl.testcustomdomain.com/graphql/realtime"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
+        const header = decodeProtocolHeader(protocol);
+        expect(header["Authorization"]).toBe("token");
         done();
         return new myWebSocket();
       }
@@ -351,7 +379,7 @@ describe("RealTime subscription link", () => {
   });
 
   test("Initialize WebSocket correctly for AWS_LAMBDA", (done) => {
-    expect.assertions(2);
+    expect.assertions(3);
     jest.spyOn(Date.prototype, "toISOString").mockImplementation(
       jest.fn(() => {
         return "2019-11-13T18:47:04.733Z";
@@ -360,9 +388,11 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://awslambdatesturl1234567890.appsync-realtime-api.us-west-2.amazonaws.com/graphql?header=eyJBdXRob3JpemF0aW9uIjoidG9rZW4iLCJob3N0IjoiYXdzbGFtYmRhdGVzdHVybDEyMzQ1Njc4OTAuYXBwc3luYy1hcGkudXMtd2VzdC0yLmFtYXpvbmF3cy5jb20ifQ==&payload=e30="
+          "wss://awslambdatesturl1234567890.appsync-realtime-api.us-west-2.amazonaws.com/graphql"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
+        const header = decodeProtocolHeader(protocol);
+        expect(header["Authorization"]).toBe("token");
         done();
         return new myWebSocket();
       }
@@ -390,7 +420,7 @@ describe("RealTime subscription link", () => {
   });
 
   test("Initialize WebSocket correctly for AWS_LAMBDA with custom domain", (done) => {
-    expect.assertions(2);
+    expect.assertions(3);
     jest.spyOn(Date.prototype, "toISOString").mockImplementation(
       jest.fn(() => {
         return "2019-11-13T18:47:04.733Z";
@@ -399,9 +429,11 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://awslambdatesturl.testcustomdomain.com/graphql/realtime?header=eyJBdXRob3JpemF0aW9uIjoidG9rZW4iLCJob3N0IjoiYXdzbGFtYmRhdGVzdHVybC50ZXN0Y3VzdG9tZG9tYWluLmNvbSJ9&payload=e30="
+          "wss://awslambdatesturl.testcustomdomain.com/graphql/realtime"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
+        const header = decodeProtocolHeader(protocol);
+        expect(header["Authorization"]).toBe("token");
         done();
         return new myWebSocket();
       }
@@ -455,14 +487,11 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         // WebSocket should connect to the proxy, not directly to AppSync
-        // The header should contain the original AppSync host for auth
-        const urlObj = new URL(url);
-        expect(urlObj.origin + urlObj.pathname).toBe(
+        expect(url).toBe(
           "wss://d111111abcdef8.cloudfront.net/realtime"
         );
-        // Decode the header to verify the host is the AppSync endpoint, not CloudFront
-        const headerB64 = urlObj.searchParams.get("header");
-        const header = JSON.parse(Buffer.from(headerB64, "base64").toString());
+        // Decode the header from the protocol to verify the host is the AppSync endpoint, not CloudFront
+        const header = decodeProtocolHeader(protocol);
         expect(header.host).toBe(
           "proxytesturl12345678901234567.appsync-api.us-west-2.amazonaws.com"
         );
@@ -504,12 +533,10 @@ describe("RealTime subscription link", () => {
     );
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
-        const urlObj = new URL(url);
-        expect(urlObj.origin + urlObj.pathname).toBe(
+        expect(url).toBe(
           "wss://mycdn.example.com/realtime"
         );
-        const headerB64 = urlObj.searchParams.get("header");
-        const header = JSON.parse(Buffer.from(headerB64, "base64").toString());
+        const header = decodeProtocolHeader(protocol);
         expect(header.host).toBe(
           "cognitoproxytesturl123456789.appsync-api.us-west-2.amazonaws.com"
         );
@@ -555,9 +582,9 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://apikeytest.testcustomdomain.com/graphql/realtime?header=eyJob3N0IjoiYXBpa2V5dGVzdC50ZXN0Y3VzdG9tZG9tYWluLmNvbSIsIngtYW16LWRhdGUiOiIyMDE5MTExM1QxODQ3MDRaIiwieC1hcGkta2V5IjoieHh4eHgifQ==&payload=e30="
+          "wss://apikeytest.testcustomdomain.com/graphql/realtime"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
         const socket = new myWebSocket();
 
         setTimeout(() => {
@@ -638,9 +665,9 @@ describe("RealTime subscription link", () => {
     AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
       (url, protocol) => {
         expect(url).toBe(
-          "wss://apikeytest.testcustomdomain.com/graphql/realtime?header=eyJob3N0IjoiYXBpa2V5dGVzdC50ZXN0Y3VzdG9tZG9tYWluLmNvbSIsIngtYW16LWRhdGUiOiIyMDE5MTExM1QxODQ3MDRaIiwieC1hcGkta2V5IjoieHh4eHgifQ==&payload=e30="
+          "wss://apikeytest.testcustomdomain.com/graphql/realtime"
         );
-        expect(protocol).toBe("graphql-ws");
+        expect(Array.isArray(protocol)).toBe(true);
         const socket = new myWebSocket();
 
         setTimeout(() => {
@@ -706,4 +733,38 @@ describe("RealTime subscription link", () => {
       },
     });
   });
+
+  test("URL does not contain credentials in query string", (done) => {
+    expect.assertions(2);
+    jest.spyOn(Date.prototype, "toISOString").mockImplementation(
+      jest.fn(() => {
+        return "2019-11-13T18:47:04.733Z";
+      })
+    );
+    AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket = jest.fn(
+      (url, protocol) => {
+        // The URL must not contain any query parameters with auth material
+        expect(url.includes("?")).toBe(false);
+        // Auth should be in the protocol header instead
+        const header = decodeProtocolHeader(protocol);
+        expect(header["x-api-key"]).toBe("my-secret-key");
+        done();
+        return new myWebSocket();
+      }
+    );
+    const link = new AppSyncRealTimeSubscriptionHandshakeLink({
+      auth: {
+        type: AUTH_TYPE.API_KEY,
+        apiKey: "my-secret-key",
+      },
+      region: "us-west-2",
+      url: "https://securitytesturl12345678901.appsync-api.us-west-2.amazonaws.com/graphql",
+    });
+
+    execute(link, { query }, { client: mockClient }).subscribe({
+      error: () => { fail; },
+      next: () => { done(); },
+      complete: () => { done(); },
+    });
+  });
 });

package/lib/index.js

@@ -2594,7 +2594,7 @@ function retry(functionToRetry, args, delayFn) {
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    logger2("Attempt #".concat(attempt, " for this vars: ").concat(JSON.stringify(args)));
+                    logger2("Attempt #".concat(attempt));
                     _state.label = 1;
                 case 1:
                     _state.trys.push([
@@ -2707,6 +2707,12 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
         _this.auth = theAuth;
         _this.proxyUrl = proxy === null || proxy === void 0 ? void 0 : proxy.url;
         _this.keepAliveTimeout = keepAliveTimeoutMs;
+        if (_this.url && !_this.url.startsWith("https://")) {
+            logger3("WARNING: AppSync endpoint URL is not using HTTPS. Credentials may be sent unencrypted: ".concat(_this.url));
+        }
+        if (_this.proxyUrl && !_this.proxyUrl.startsWith("https://")) {
+            logger3("WARNING: Proxy URL is not using HTTPS. Credentials may be sent unencrypted: ".concat(_this.proxyUrl));
+        }
         if (_this.keepAliveTimeout < SERVER_KEEP_ALIVE_TIMEOUT) {
             var configName = "keepAliveTimeoutMs";
             throw new Error("".concat(configName, " must be greater than or equal to ").concat(SERVER_KEEP_ALIVE_TIMEOUT, " (").concat(_this.keepAliveTimeout, " used)."));
@@ -3004,7 +3010,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                 }
                 return new Promise(function(res, rej) {
                     return _async_to_generator(function() {
-                        var payloadString, headerString, _, headerQs, payloadQs, discoverableEndpoint, awsRealTimeUrl, err;
+                        var payloadString, headerObj, headerString, headerBase64url, discoverableEndpoint, protocols, err;
                         return _ts_generator(this, function(_state) {
                             switch(_state.label){
                                 case 0:
@@ -3026,7 +3032,6 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                     ]);
                                     this.socketStatus = 2 /* CONNECTING */ ;
                                     payloadString = "{}";
-                                    _ = JSON.stringify;
                                     return [
                                         4,
                                         this._awsRealTimeHeaderBasedAuth({
@@ -3042,11 +3047,9 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                         })
                                     ];
                                 case 2:
-                                    headerString = _.apply(JSON, [
-                                        _state.sent()
-                                    ]);
-                                    headerQs = Buffer.from(headerString).toString("base64");
-                                    payloadQs = Buffer.from(payloadString).toString("base64");
+                                    headerObj = _state.sent();
+                                    headerString = JSON.stringify(headerObj);
+                                    headerBase64url = Buffer.from(headerString).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
                                     if (this.proxyUrl) {
                                         discoverableEndpoint = this.proxyUrl.replace(/\/graphql$/, "").concat(customDomainPath).replace("https://", "wss://").replace("http://", "ws://");
                                     } else if (this.isCustomDomain(appSyncGraphqlEndpoint)) {
@@ -3056,11 +3059,15 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                         discoverableEndpoint = appSyncGraphqlEndpoint.replace("appsync-api", "appsync-realtime-api").replace("gogi-beta", "grt-beta");
                                         discoverableEndpoint = discoverableEndpoint.replace("https://", "wss://").replace("http://", "ws://");
                                     }
-                                    awsRealTimeUrl = "".concat(discoverableEndpoint, "?header=").concat(headerQs, "&payload=").concat(payloadQs);
+                                    protocols = [
+                                        "graphql-ws",
+                                        "header-".concat(headerBase64url)
+                                    ];
                                     return [
                                         4,
                                         this._initializeRetryableHandshake({
-                                            awsRealTimeUrl: awsRealTimeUrl
+                                            awsRealTimeUrl: discoverableEndpoint,
+                                            protocols: protocols
                                         })
                                     ];
                                 case 3:
@@ -3120,11 +3127,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                 };
                                 handler = headerHandler[authenticationType];
                                 if (typeof handler !== "function") {
-                                    logger3("Authentication type ".concat(authenticationType, " not supported"));
-                                    return [
-                                        2,
-                                        {}
-                                    ];
+                                    throw new NonRetryableError("Authentication type ".concat(authenticationType, " not supported"));
                                 }
                                 host = url.parse(this.url).host;
                                 return [
@@ -3298,17 +3301,18 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
             key: "_initializeRetryableHandshake",
             value: function _initializeRetryableHandshake(_0) {
                 return _async_to_generator(function(param) {
-                    var awsRealTimeUrl;
+                    var awsRealTimeUrl, protocols;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                awsRealTimeUrl = param.awsRealTimeUrl;
+                                awsRealTimeUrl = param.awsRealTimeUrl, protocols = param.protocols;
                                 logger3("Initializaling retryable Handshake");
                                 return [
                                     4,
                                     jitteredExponentialRetry(this._initializeHandshake.bind(this), [
                                         {
-                                            awsRealTimeUrl: awsRealTimeUrl
+                                            awsRealTimeUrl: awsRealTimeUrl,
+                                            protocols: protocols
                                         }
                                     ])
                                 ];
@@ -3326,12 +3330,12 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
             key: "_initializeHandshake",
             value: function _initializeHandshake(_0) {
                 return _async_to_generator(function(param) {
-                    var _this, awsRealTimeUrl, err, errorType, errorCode;
+                    var _this, awsRealTimeUrl, protocols, err, errorType, errorCode;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 _this = this;
-                                awsRealTimeUrl = param.awsRealTimeUrl;
+                                awsRealTimeUrl = param.awsRealTimeUrl, protocols = param.protocols;
                                 logger3("Initializing handshake ".concat(awsRealTimeUrl));
                                 _state.label = 1;
                             case 1:
@@ -3345,7 +3349,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                     4,
                                     function() {
                                         return new Promise(function(res, rej) {
-                                            var newSocket = _AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket(awsRealTimeUrl, "graphql-ws");
+                                            var newSocket = _AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket(awsRealTimeUrl, protocols);
                                             newSocket.onerror = function() {
                                                 logger3("WebSocket connection error");
                                             };
@@ -3379,13 +3383,20 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                                 rej(new Error(JSON.stringify(event)));
                                             };
                                             _this.awsRealTimeSocket.onmessage = function(message) {
-                                                logger3("subscription message from AWS AppSyncRealTime: ".concat(message.data, " "));
-                                                var data = JSON.parse(message.data);
+                                                var data;
+                                                try {
+                                                    data = JSON.parse(message.data);
+                                                } catch (e) {
+                                                    logger3("Failed to parse WebSocket message");
+                                                    return;
+                                                }
                                                 var type = data.type, tmp = data.payload, _ref = tmp === void 0 ? {} : tmp, _ref_connectionTimeoutMs = _ref.connectionTimeoutMs, connectionTimeoutMs = _ref_connectionTimeoutMs === void 0 ? DEFAULT_KEEP_ALIVE_TIMEOUT : _ref_connectionTimeoutMs;
+                                                logger3("subscription message from AWS AppSyncRealTime: ".concat(type));
                                                 if (type === "connection_ack" /* GQL_CONNECTION_ACK */ ) {
                                                     ackOk = true;
+                                                    var validTimeout = typeof connectionTimeoutMs === "number" && connectionTimeoutMs >= SERVER_KEEP_ALIVE_TIMEOUT ? connectionTimeoutMs : DEFAULT_KEEP_ALIVE_TIMEOUT;
                                                     var _this_keepAliveTimeout;
-                                                    _this.keepAliveTimeout = (_this_keepAliveTimeout = _this.keepAliveTimeout) !== null && _this_keepAliveTimeout !== void 0 ? _this_keepAliveTimeout : connectionTimeoutMs;
+                                                    _this.keepAliveTimeout = (_this_keepAliveTimeout = _this.keepAliveTimeout) !== null && _this_keepAliveTimeout !== void 0 ? _this_keepAliveTimeout : validTimeout;
                                                     _this.awsRealTimeSocket.onmessage = _this._handleIncomingSubscriptionMessage.bind(_this);
                                                     _this.awsRealTimeSocket.onerror = function(err) {
                                                         logger3(err);
@@ -3446,8 +3457,15 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
         {
             key: "_handleIncomingSubscriptionMessage",
             value: function _handleIncomingSubscriptionMessage(message) {
-                logger3("subscription message from AWS AppSync RealTime: ".concat(message.data));
-                var _JSON_parse = JSON.parse(message.data), _JSON_parse_id = _JSON_parse.id, id = _JSON_parse_id === void 0 ? "" : _JSON_parse_id, payload = _JSON_parse.payload, type = _JSON_parse.type;
+                var parsed;
+                try {
+                    parsed = JSON.parse(message.data);
+                } catch (e) {
+                    logger3("Failed to parse incoming subscription message");
+                    return;
+                }
+                var _parsed_id = parsed.id, id = _parsed_id === void 0 ? "" : _parsed_id, payload = parsed.payload, type = parsed.type;
+                logger3("subscription message from AWS AppSync RealTime: ".concat(type, " id: ").concat(id));
                 var _ref = this.subscriptionObserverMap.get(id) || {}, _ref_observer = _ref.observer, observer = _ref_observer === void 0 ? null : _ref_observer, _ref_query = _ref.query, query = _ref_query === void 0 ? "" : _ref_query, _ref_variables = _ref.variables, variables = _ref_variables === void 0 ? {} : _ref_variables, _ref_startAckTimeoutId = _ref.startAckTimeoutId, startAckTimeoutId = _ref_startAckTimeoutId === void 0 ? 0 : _ref_startAckTimeoutId, _ref_subscriptionReadyCallback = _ref.subscriptionReadyCallback, subscriptionReadyCallback = _ref_subscriptionReadyCallback === void 0 ? null : _ref_subscriptionReadyCallback, _ref_subscriptionFailedCallback = _ref.subscriptionFailedCallback, subscriptionFailedCallback = _ref_subscriptionFailedCallback === void 0 ? null : _ref_subscriptionFailedCallback;
                 logger3({
                     id: id,

package/lib/index.mjs

@@ -2571,7 +2571,7 @@ function retry(functionToRetry, args, delayFn) {
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    logger2("Attempt #".concat(attempt, " for this vars: ").concat(JSON.stringify(args)));
+                    logger2("Attempt #".concat(attempt));
                     _state.label = 1;
                 case 1:
                     _state.trys.push([
@@ -2684,6 +2684,12 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
         _this.auth = theAuth;
         _this.proxyUrl = proxy === null || proxy === void 0 ? void 0 : proxy.url;
         _this.keepAliveTimeout = keepAliveTimeoutMs;
+        if (_this.url && !_this.url.startsWith("https://")) {
+            logger3("WARNING: AppSync endpoint URL is not using HTTPS. Credentials may be sent unencrypted: ".concat(_this.url));
+        }
+        if (_this.proxyUrl && !_this.proxyUrl.startsWith("https://")) {
+            logger3("WARNING: Proxy URL is not using HTTPS. Credentials may be sent unencrypted: ".concat(_this.proxyUrl));
+        }
         if (_this.keepAliveTimeout < SERVER_KEEP_ALIVE_TIMEOUT) {
             var configName = "keepAliveTimeoutMs";
             throw new Error("".concat(configName, " must be greater than or equal to ").concat(SERVER_KEEP_ALIVE_TIMEOUT, " (").concat(_this.keepAliveTimeout, " used)."));
@@ -2981,7 +2987,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
                 }
                 return new Promise(function(res, rej) {
                     return _async_to_generator(function() {
-                        var payloadString, headerString, _, headerQs, payloadQs, discoverableEndpoint, awsRealTimeUrl, err;
+                        var payloadString, headerObj, headerString, headerBase64url, discoverableEndpoint, protocols, err;
                         return _ts_generator(this, function(_state) {
                             switch(_state.label){
                                 case 0:
@@ -3003,7 +3009,6 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
                                     ]);
                                     this.socketStatus = 2 /* CONNECTING */ ;
                                     payloadString = "{}";
-                                    _ = JSON.stringify;
                                     return [
                                         4,
                                         this._awsRealTimeHeaderBasedAuth({
@@ -3019,11 +3024,9 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
                                         })
                                     ];
                                 case 2:
-                                    headerString = _.apply(JSON, [
-                                        _state.sent()
-                                    ]);
-                                    headerQs = Buffer.from(headerString).toString("base64");
-                                    payloadQs = Buffer.from(payloadString).toString("base64");
+                                    headerObj = _state.sent();
+                                    headerString = JSON.stringify(headerObj);
+                                    headerBase64url = Buffer.from(headerString).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
                                     if (this.proxyUrl) {
                                         discoverableEndpoint = this.proxyUrl.replace(/\/graphql$/, "").concat(customDomainPath).replace("https://", "wss://").replace("http://", "ws://");
                                     } else if (this.isCustomDomain(appSyncGraphqlEndpoint)) {
@@ -3033,11 +3036,15 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
                                         discoverableEndpoint = appSyncGraphqlEndpoint.replace("appsync-api", "appsync-realtime-api").replace("gogi-beta", "grt-beta");
                                         discoverableEndpoint = discoverableEndpoint.replace("https://", "wss://").replace("http://", "ws://");
                                     }
-                                    awsRealTimeUrl = "".concat(discoverableEndpoint, "?header=").concat(headerQs, "&payload=").concat(payloadQs);
+                                    protocols = [
+                                        "graphql-ws",
+                                        "header-".concat(headerBase64url)
+                                    ];
                                     return [
                                         4,
                                         this._initializeRetryableHandshake({
-                                            awsRealTimeUrl: awsRealTimeUrl
+                                            awsRealTimeUrl: discoverableEndpoint,
+                                            protocols: protocols
                                         })
                                     ];
                                 case 3:
@@ -3097,11 +3104,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
                                 };
                                 handler = headerHandler[authenticationType];
                                 if (typeof handler !== "function") {
-                                    logger3("Authentication type ".concat(authenticationType, " not supported"));
-                                    return [
-                                        2,
-                                        {}
-                                    ];
+                                    throw new NonRetryableError("Authentication type ".concat(authenticationType, " not supported"));
                                 }
                                 host = url.parse(this.url).host;
                                 return [
@@ -3275,17 +3278,18 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
             key: "_initializeRetryableHandshake",
             value: function _initializeRetryableHandshake(_0) {
                 return _async_to_generator(function(param) {
-                    var awsRealTimeUrl;
+                    var awsRealTimeUrl, protocols;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                awsRealTimeUrl = param.awsRealTimeUrl;
+                                awsRealTimeUrl = param.awsRealTimeUrl, protocols = param.protocols;
                                 logger3("Initializaling retryable Handshake");
                                 return [
                                     4,
                                     jitteredExponentialRetry(this._initializeHandshake.bind(this), [
                                         {
-                                            awsRealTimeUrl: awsRealTimeUrl
+                                            awsRealTimeUrl: awsRealTimeUrl,
+                                            protocols: protocols
                                         }
                                     ])
                                 ];
@@ -3303,12 +3307,12 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
             key: "_initializeHandshake",
             value: function _initializeHandshake(_0) {
                 return _async_to_generator(function(param) {
-                    var _this, awsRealTimeUrl, err, errorType, errorCode;
+                    var _this, awsRealTimeUrl, protocols, err, errorType, errorCode;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 _this = this;
-                                awsRealTimeUrl = param.awsRealTimeUrl;
+                                awsRealTimeUrl = param.awsRealTimeUrl, protocols = param.protocols;
                                 logger3("Initializing handshake ".concat(awsRealTimeUrl));
                                 _state.label = 1;
                             case 1:
@@ -3322,7 +3326,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
                                     4,
                                     function() {
                                         return new Promise(function(res, rej) {
-                                            var newSocket = _AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket(awsRealTimeUrl, "graphql-ws");
+                                            var newSocket = _AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket(awsRealTimeUrl, protocols);
                                             newSocket.onerror = function() {
                                                 logger3("WebSocket connection error");
                                             };
@@ -3356,13 +3360,20 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
                                                 rej(new Error(JSON.stringify(event)));
                                             };
                                             _this.awsRealTimeSocket.onmessage = function(message) {
-                                                logger3("subscription message from AWS AppSyncRealTime: ".concat(message.data, " "));
-                                                var data = JSON.parse(message.data);
+                                                var data;
+                                                try {
+                                                    data = JSON.parse(message.data);
+                                                } catch (e) {
+                                                    logger3("Failed to parse WebSocket message");
+                                                    return;
+                                                }
                                                 var type = data.type, tmp = data.payload, _ref = tmp === void 0 ? {} : tmp, _ref_connectionTimeoutMs = _ref.connectionTimeoutMs, connectionTimeoutMs = _ref_connectionTimeoutMs === void 0 ? DEFAULT_KEEP_ALIVE_TIMEOUT : _ref_connectionTimeoutMs;
+                                                logger3("subscription message from AWS AppSyncRealTime: ".concat(type));
                                                 if (type === "connection_ack" /* GQL_CONNECTION_ACK */ ) {
                                                     ackOk = true;
+                                                    var validTimeout = typeof connectionTimeoutMs === "number" && connectionTimeoutMs >= SERVER_KEEP_ALIVE_TIMEOUT ? connectionTimeoutMs : DEFAULT_KEEP_ALIVE_TIMEOUT;
                                                     var _this_keepAliveTimeout;
-                                                    _this.keepAliveTimeout = (_this_keepAliveTimeout = _this.keepAliveTimeout) !== null && _this_keepAliveTimeout !== void 0 ? _this_keepAliveTimeout : connectionTimeoutMs;
+                                                    _this.keepAliveTimeout = (_this_keepAliveTimeout = _this.keepAliveTimeout) !== null && _this_keepAliveTimeout !== void 0 ? _this_keepAliveTimeout : validTimeout;
                                                     _this.awsRealTimeSocket.onmessage = _this._handleIncomingSubscriptionMessage.bind(_this);
                                                     _this.awsRealTimeSocket.onerror = function(err) {
                                                         logger3(err);
@@ -3423,8 +3434,15 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(ApolloLink
         {
             key: "_handleIncomingSubscriptionMessage",
             value: function _handleIncomingSubscriptionMessage(message) {
-                logger3("subscription message from AWS AppSync RealTime: ".concat(message.data));
-                var _JSON_parse = JSON.parse(message.data), _JSON_parse_id = _JSON_parse.id, id = _JSON_parse_id === void 0 ? "" : _JSON_parse_id, payload = _JSON_parse.payload, type = _JSON_parse.type;
+                var parsed;
+                try {
+                    parsed = JSON.parse(message.data);
+                } catch (e) {
+                    logger3("Failed to parse incoming subscription message");
+                    return;
+                }
+                var _parsed_id = parsed.id, id = _parsed_id === void 0 ? "" : _parsed_id, payload = parsed.payload, type = parsed.type;
+                logger3("subscription message from AWS AppSync RealTime: ".concat(type, " id: ").concat(id));
                 var _ref = this.subscriptionObserverMap.get(id) || {}, _ref_observer = _ref.observer, observer = _ref_observer === void 0 ? null : _ref_observer, _ref_query = _ref.query, query = _ref_query === void 0 ? "" : _ref_query, _ref_variables = _ref.variables, variables = _ref_variables === void 0 ? {} : _ref_variables, _ref_startAckTimeoutId = _ref.startAckTimeoutId, startAckTimeoutId = _ref_startAckTimeoutId === void 0 ? 0 : _ref_startAckTimeoutId, _ref_subscriptionReadyCallback = _ref.subscriptionReadyCallback, subscriptionReadyCallback = _ref_subscriptionReadyCallback === void 0 ? null : _ref_subscriptionReadyCallback, _ref_subscriptionFailedCallback = _ref.subscriptionFailedCallback, subscriptionFailedCallback = _ref_subscriptionFailedCallback === void 0 ? null : _ref_subscriptionFailedCallback;
                 logger3({
                     id: id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-appsync-subscription-link",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "main": "lib/index.js",
   "module": "lib/index.mjs",
   "types": "lib/index.d.ts",