Are socket.io values in the form `socket.variable = data` accesible to the client?

Question

For those of you familiar with socket.io suppose I store data in the following way:

socket.super_secret_data = "secret";

Is that data accessible by the client? I'm specifically concerned whether it's editable by the client.

score 0 · Answer 1 · answered Jul 25 '17 at 03:16

0

If that's on the server, then no. Only data you explicitly emit from the server will be sent to the clients. If you are running the client in chrome you can actually see all the data that's emitted by server in the developer console. Debugging WebSocket in Google Chrome

answered Jul 25 '17 at 03:16

88jayto

659
1
5
20

Ok. I logged the client side socket and couldn't see any server side values. The values I'm worried about are not emitted, just as you say. I wasn't sure how socket.variable = value worked and I just want my data to be protected. I'm pretty convinced that that data is protected but I wanted to be sure. – Jul 25 '17 at 03:20

score 0 · Accepted Answer · answered Jul 25 '17 at 04:00

The socket.io socket object is a completely different object on client and server. While they each represent opposite ends of the same TCP connection, they are completely different objects in completely different JS engines (actually, either end can be run in many different languages).

So, a custom property you set on one is not reflected in the other in any way. Server properties stay private to the server-side socket object and client properties stay private to the client-side socket object. Once the connection is initialized, the only data of yours that is sent back and forth is data that you explicitly .emit() to the other end of the socket.

Is that data accessible by the client? I'm specifically concerned whether it's editable by the client.

No, it is not accessible by the client. That property is only on the server-side socket object.

Are socket.io values in the form `socket.variable = data` accesible to the client?

2 Answers2