# SecureSocketServer

> Documentation for Redweb 0.13.3. Install that exact version when following these examples.

HTTPS + WebSocket pairing. Mirrors `SocketServer` but wraps an HTTPS server built from the provided TLS files.

## Explain it like I’m five

SecureSocketServer is the encrypted version of the WebSocket switchboard: clients use wss:// and the connection stays protected from the first handshake onward.

## When should I use it?

Use it when Redweb directly owns a TLS WebSocket listener rather than sharing an externally terminated HTTPS connection.

## Follow the example

This API pattern illustrates the named surface; it may require application-owned classes, credentials, or assets. Start from a complete recipe for a runnable application.

```js
const { SecureSocketServer } = require('redweb')
const { GameRoute } = require('./routes/GameRoute')

new SecureSocketServer({
  port: 3443,
  ssl: { key: './certs/dev.key', cert: './certs/dev.crt' },
  routes: [GameRoute],
})
```

1. TLS material is loaded to create or configure the HTTPS listener.
2. WebSocket upgrades travel through the same route selection used by SocketServer.
3. Route handlers see ordinary Redweb sockets after the secure handshake completes.

## Options

- port: number (default 3000)
- listen: boolean (default true for owned servers); supplied servers do not listen unless explicitly true
- server: existing https.Server to attach to without double-listening (optional)
- ssl.key and ssl.cert: required file paths
- routes: array of SocketRoute subclasses

## Methods and members

### constructor(options)

Loads TLS files or reuses a supplied HTTPS server, registers the provided routes, attaches upgrade handling, and starts listening only when Redweb owns the server or listen is explicitly true.

### addRoute(RouteClass)

Same runtime route attachment as `SocketServer`.

### shutdown()

Stops routes, services, and the HTTPS listener.

## What should I watch for?

Do not duplicate TLS termination accidentally. If a proxy already provides wss:// publicly, attach SocketServer behind it and validate forwarded origin information.