How to use CHAP Authentication (Challenge Response Authentication) for webSockets?

In computing, the Challenge-Handshake Authentication Protocol (CHAP) authenticates a user or network host to an authenticating entity. CHAP is a 3 way handshake:

1. Client Connects to the websocket server, server then sends a challenge string (random characters of random or set length) to client.
2. Client responds with the hash of the challenge+shared secret
3. Server calculates the challenge it sent and the ‘shared secret’ it has locally and compares the client’s hash to it’s own and either authenticates (adds it to approved clients) or drops the client.

You can get a bit further and if the client was dropped we can add him to a blocked list with a timestamp.  If the client tries to connect I check if he is in the blocked list and if his timestamp is old enough. Then continue with the CHAP auth for the client again.