If you want passwords, the best way is to use TLS, and then send the passwords in clear. This is simpler than a challenge-response mechanism.

If you however can't have TLS for websockets, but you have TLS for the code (delivered over HTTP), best thing to do is to do the login via HTTPS, generate session cookies (or some other form of keys) and use them to authenticate to the websocket. If you make challenge-response in the clear, an attacker can brute-force the password using that communication. With the session approach, an attacker can only capture the session of your (un-sensitive) game, but not the (possibly re-used) password. However when you have TLS on neither, you should let users authenticate through third parties, e.g. through OpenID. Then you don't need to handle sensitive data like passwords. OpenID is a good option for the other cases too.

What's the best way to authenticate an user using a websocket?
I want to see if the HTTP proxy support for an application is working correctly. In order to check this I have installed a Ubuntu VirtualBox on my Mac laptop and I want to configure the virtual machine so that it has no access to any other internet host except my test proxy server.

How can I configure the virtual machine? From what I've read it sounds like "route add ..." should be able to do it but I'm not sure exactly how to use it.

Please advise! Thanks!
