mORMot Open Source

in your 31 - WebSockets samples with both chat and longwork project i tried to use encryption over http and couldn't find how to
encrypt my request and responses. simply i changed chat server run method like this

...
  Server := TSQLRestServerFullMemory.CreateWithOwnModel([]);
  try
    Server.CreateMissingTables;
    Server.ServiceDefine(TChatService, [IChatService], sicShared).
      SetOptions([], [optExecLockedPerInterface]). // thread-safe fConnected[]
      ByPassAuthentication := true;
    HttpServer             := TSQLHttpServer.Create('8888', [Server], '+', useBidirSocket, 32, secSynShaAes);
    try
      HttpServer.WebSocketsEnable(Server, PROJECT31_TRANSMISSION_KEY).
        Settings.SetFullLog; // full verbose logs for this demo
      CompressShaAesSetKey('asdqwe123', TAESECB);
...

then client run method like this

....
  Client := TSQLHttpClientWebsockets.Create('127.0.0.1', '8888', TSQLModel.Create([]));
  try
    Client.Compression := [hcSynShaAes];
    Client.Model.Owner := Client;
    Client.WebSocketsUpgrade(PROJECT31_TRANSMISSION_KEY);
   
    CompressShaAesSetKey('asdqwe123', TAESECB);

    if not Client.ServerTimeStampSynchronize then
        raise EServiceException.Create(
        'Error connecting to the server: please run Project31ChatServer.exe');
    Client.ServiceDefine([IChatService], sicShared);
    if not Client.Services.Resolve(IChatService, Service) then
        raise EServiceException.Create('Service IChatService unavailable');
.....

then i used broser like this
http://localhost:8888/root/ChatService/blabla?pseudo=Browser&msg=Test%20Message

result: message "Test Message" sended to all clients

questions
1- how can i prevent broswer or un authorized service calls like browser call above. because each call creates a null callback interface so that is
a bit security issue for everyone.

2- is there any other ways using callbacks with your servers except websocket

3- is there any way to learn client ip from your rest servers?. all servicecontext.request.call.inhead is empty.

thank you

Explanation:
i want to design a server which will use only socket or wininet like indy's TIdTCPServer. Not want REST because of http.sys's needs admin privileges so;

i will transport my own datasets and objects with encryption (Not SSL i will write it myself) to client side and maybe i will declare a few event.
also i will transport files too. the database which will i use is not important on server side.

Question:
so can anyone suggest me that which mormot objects i can use with his scenario? an example will be better:)