You can’t do this
because, to quote this comment on a stackoverflow post, “The initial handshake looks like HTTP (so that HTTP requests can be handled on the same port number) but the spec specifically says it’s not HTTP, so there’s no way to add extra headers”
So, we have to send authentication over the websocket itself.