@@ -2,6 +2,7 @@ package paramtoken

 import (

 	"net/http"

+	"regexp"

 	"strings"

 	"github.com/openshift/origin/pkg/auth/authenticator"

@@ -26,6 +27,11 @@ func New(param string, auth authenticator.Token, removeParam bool) *Authenticato

 }

 func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

+	// Only accept query param auth for websocket connections

+	if !isWebSocketRequest(req) {

+		return nil, false, nil

+	}

+

 	q := req.URL.Query()

 	token := strings.TrimSpace(q.Get(a.param))

 	if token == "" {

@@ -38,3 +44,13 @@ func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool,

 	}

 	return user, ok, err

 }

+

+var (

+	// connectionUpgradeRegex matches any Connection header value that includes upgrade

+	connectionUpgradeRegex = regexp.MustCompile("(^|.*,\\s*)upgrade($|\\s*,)")

+)

+

+// isWebSocketRequest returns true if the incoming request contains connection upgrade headers for WebSockets.

+func isWebSocketRequest(req *http.Request) bool {

+	return connectionUpgradeRegex.MatchString(strings.ToLower(req.Header.Get("Connection"))) && strings.ToLower(req.Header.Get("Upgrade")) == "websocket"

+}