diff --git a/runtime/backend/package.json b/runtime/backend/package.json
index 799e8d5a..7b6a78f4 100644
--- a/runtime/backend/package.json
+++ b/runtime/backend/package.json
@@ -56,14 +56,14 @@
     "@nestjs/config": "^2.0.1",
     "@nestjs/core": "^8.0.0",
     "@nestjs/event-emitter": "^1.3.1",
-    "@nestjs/websockets": "^8.0.0",
-    "@nestjs/platform-ws": "^8.0.0",
     "@nestjs/jwt": "^8.0.1",
     "@nestjs/mongoose": "^9.1.0",
     "@nestjs/passport": "^8.2.2",
     "@nestjs/platform-express": "^8.0.0",
+    "@nestjs/platform-ws": "^8.0.0",
     "@nestjs/schedule": "^2.0.1",
     "@nestjs/swagger": "^5.2.1",
+    "@nestjs/websockets": "^8.0.0",
     "axios": "^0.27.2",
     "cookie-parser": "^1.4.6",
     "cron": "^2.0.0",
@@ -90,6 +90,7 @@
     "@nestjs/cli": "^8.0.0",
     "@nestjs/schematics": "^8.0.0",
     "@nestjs/testing": "^8.0.0",
+    "@types/cookie": "^0.5.1",
     "@types/cookie-parser": "^1.4.3",
     "@types/cron": "^2.0.0",
     "@types/express": "^4.17.13",
@@ -100,6 +101,7 @@
     "@types/supertest": "^2.0.11",
     "@typescript-eslint/eslint-plugin": "^5.0.0",
     "@typescript-eslint/parser": "^5.0.0",
+    "cookie": "^0.5.0",
     "eslint": "^8.0.1",
     "eslint-config-prettier": "^8.3.0",
     "eslint-plugin-prettier": "^4.0.0",
diff --git a/runtime/backend/src/common/gateways/BaseGateway.ts b/runtime/backend/src/common/gateways/BaseGateway.ts
index 1e633a36..21862ada 100644
--- a/runtime/backend/src/common/gateways/BaseGateway.ts
+++ b/runtime/backend/src/common/gateways/BaseGateway.ts
@@ -18,7 +18,8 @@ import {
   MessageBody,
 } from "@nestjs/websockets";
 import { Server } from "https";
-import { JwtService } from "@nestjs/jwt";
+import cookie from "cookie";
+import cookieParser from "cookie-parser";
 
 // internal dependencies
 import dappConfigLoader from "../../../config/dapp";
@@ -49,11 +50,21 @@ export abstract class BaseGateway
   async handleConnection(ws: any, req: any) {
     // const challenge = this.getChallengeFromUrl(client);
     // this.clients.push(challenge);
+    console.log(req.headers.cookie);
+
     const cookies = req.headers.cookie.split(";");
     const challenge = cookies.find((cookie: string) =>
       cookie.trim().includes("challenge"),
     );
 
+    const c: any = cookie.parse(req.headers.cookie);
+    const decoded = cookieParser.signedCookie(
+      decodeURIComponent(c.challenge),
+      process.env.SECURITY_AUTH_TOKEN_SECRET,
+    );
+
+    console.log({ decoded });
+
     this.clients.push(challenge.split("=")[1]);
     ws.challenge = challenge;
 
diff --git a/runtime/backend/src/common/routes/AuthController.ts b/runtime/backend/src/common/routes/AuthController.ts
index 1bec985a..ef0c6ab2 100644
--- a/runtime/backend/src/common/routes/AuthController.ts
+++ b/runtime/backend/src/common/routes/AuthController.ts
@@ -202,7 +202,7 @@ export class AuthController {
     response.cookie("challenge", authChallenge, {
       httpOnly: true,
       domain: authCookie.domain,
-      signed: false,
+      signed: true,
     });
 
     // serves the authentication challenge