Seeing as giving any old website total access to Bluetooth isn't ideal, some sort of Authentication / Authorization system needs to be implemented.

We should assume that the websocket connection is secure since (1) websites cannot access messages of another website and (2) all network transfer is on 127.0.0.1

There are a few possibilities for these mechanisms:

1. Done together. I.E., user is asked for Website [X] to have permission to communicate with BT device [y].

2. Done separately. I.E., user first gives permission for Website [X] to use bluetooth, then Website [X] asks for permission to communicate with BT device [y] later. In this way, Website [X] can communicate with multiple devices over the lifetime of the app, and similarly the user can revoke access to Website [X] entirely.

Considerations

should the website be allowed to see all of the current bluetooth devices? I would say yes, since this is effectively the same as if the website was a native app. Extra permissions and handling regarding this would only unnecessarily increase application complexity.

Linking website to connect app

• Some sort of token can be issued by the websocket server to the websocket client.
  • this token can contain data within it about the related website/cube or this can be stored in a database on the connect app.
• Some sort of external verification should be done, I.E. user is asked to copy a 6-digit pin from the connect app to the server.

the user could disable BT, manually disconnect device, or device loses connection.