Socket.IO Authentication

Question

I am trying to use Socket.IO in Node.js, and am trying to allow the server to give an identity to each of the Socket.IO clients. As the socket code is outside the scope of the http server code, it doesn't have easy access to the request information sent, so I'm assuming it will need to be sent up during the connection. What is the best way to

1) get the information to the server about who is connecting via Socket.IO

2) authenticate who they say they are (I'm currently using Express, if that makes things any easier)

score 107 · Accepted Answer · edited Sep 27 '13 at 08:37

107

Use connect-redis and have redis as your session store for all authenticated users. Make sure on authentication you send the key (normally req.sessionID) to the client. Have the client store this key in a cookie.

On socket connect (or anytime later) fetch this key from the cookie and send it back to the server. Fetch the session information in redis using this key. (GET key)

Eg:

Server side (with redis as session store):

req.session.regenerate...
res.send({rediskey: req.sessionID});

Client side:

//store the key in a cookie
SetCookie('rediskey', <%= rediskey %>); //http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx

//then when socket is connected, fetch the rediskey from the document.cookie and send it back to server
var socket = new io.Socket();

socket.on('connect', function() {
  var rediskey = GetCookie('rediskey'); //http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx
  socket.send({rediskey: rediskey});
});

Server side:

//in io.on('connection')
io.on('connection', function(client) {
  client.on('message', function(message) {

    if(message.rediskey) {
      //fetch session info from redis
      redisclient.get(message.rediskey, function(e, c) {
        client.user_logged_in = c.username;
      });
    }

  });
});

edited Sep 27 '13 at 08:37

karaxuna

26,752
13
82
117

answered Jan 21 '11 at 02:20

Shripad Krishna

10,463
4
52
65

3

There is a new interesting link about this => http://www.danielbaulig.de/socket-ioexpress/ – Alfred Aug 14 '11 at 19:33
1

aha! That link is really good. This is outdated (uses Socket.IO 0.6.3)! Essentially the same concept. Fetch cookie, check in session store and authenticate :) – Shripad Krishna Aug 14 '11 at 19:51
@NightWolf it should work because you are fetching the cookie in javascript not in flash (actionscript). `GetCookie` is javascript function. – Shripad Krishna Nov 09 '12 at 07:23
1

@Alfred that link seems to be dead now :( – Pro Q Aug 08 '16 at 04:28
@Alfred's link is valid again 2018-02-01 – Tom Feb 02 '18 at 03:38

score 33 · Answer 2 · answered Jan 16 '14 at 15:01

I know this is bit old, but for future readers in addition to the approach of parsing cookie and retrieving the session from the storage (eg. passport.socketio ) you might also consider a token based approach.

In this example I use JSON Web Tokens which are pretty standard. You have to give to the client page the token, in this example imagine an authentication endpoint that returns JWT:

var jwt = require('jsonwebtoken');
// other requires

app.post('/login', function (req, res) {

  // TODO: validate the actual user user
  var profile = {
    first_name: 'John',
    last_name: 'Doe',
    email: 'john@doe.com',
    id: 123
  };

  // we are sending the profile in the token
  var token = jwt.sign(profile, jwtSecret, { expiresInMinutes: 60*5 });

  res.json({token: token});
});

Now, your socket.io server can be configured as follows:

var socketioJwt = require('socketio-jwt');

var sio = socketIo.listen(server);

sio.set('authorization', socketioJwt.authorize({
  secret: jwtSecret,
  handshake: true
}));

sio.sockets
  .on('connection', function (socket) {
     console.log(socket.handshake.decoded_token.email, 'has joined');
     //socket.on('event');
  });

The socket.io-jwt middleware expects the token in a query string, so from the client you only have to attach it when connecting:

var socket = io.connect('', {
  query: 'token=' + token
});

I wrote a more detailed explanation about this method and cookies here.

Hey! Quick question, why are you sending the profile with the token if it can't be decoded on the client? — Carpetfizz, Jan 05 '15 at 08:30
It can. JWT is just base64 , digital signed. The client can decode it, but it can't validate the signature in this example. — José F. Romaniello, Jun 09 '15 at 01:23
@JoséF.Romaniello your article is down, I like your approach though. — captDaylight, Oct 19 '20 at 16:32

score 33 · Answer 3 · answered Jan 24 '11 at 14:11

I also liked the way pusherapp does private channels. enter image description here

A unique socket id is generated and sent to the browser by Pusher. This is sent to your application (1) via an AJAX request which authorizes the user to access the channel against your existing authentication system. If successful your application returns an authorization string to the browser signed with you Pusher secret. This is sent to Pusher over the WebSocket, which completes the authorization (2) if the authorization string matches.

Because also socket.io has unique socket_id for every socket.

socket.on('connect', function() {
        console.log(socket.transport.sessionid);
});

They used signed authorization strings to authorize users.

I haven't yet mirrored this to socket.io, but I think it could be pretty interesting concept.

This is awesome. But it would be easier to just use cookies if your app server and websocket server aren't separated. But you generally would like to separate the two(it will be easier to scale the socket server if separated). So it is good :) — Shripad Krishna, Jan 24 '11 at 14:32
@Shripad you are completely true and I also really like your implementation :P — Alfred, Jan 24 '11 at 15:16

score 5 · Answer 4 · edited Jun 20 '20 at 09:12

Here is my attempt to have the following working:

express: 4.14
socket.io: 1.5
passport (using sessions): 0.3
redis: 2.6 (Really fast data structure to handle sessions; but you can use others like MongoDB too. However, I encourage you to use this for session data + MongoDB to store other persistent data like Users)

Since you might want to add some API requests as well, we'll also use http package to have both HTTP and Web socket working in the same port.

server.js

The following extract only includes everything you need to set the previous technologies up. You can see the complete server.js version which I used in one of my projects here.

import http from 'http';
import express from 'express';
import passport from 'passport';
import { createClient as createRedisClient } from 'redis';
import connectRedis from 'connect-redis';
import Socketio from 'socket.io';

// Your own socket handler file, it's optional. Explained below.
import socketConnectionHandler from './sockets'; 

// Configuration about your Redis session data structure.
const redisClient = createRedisClient();
const RedisStore = connectRedis(Session);
const dbSession = new RedisStore({
  client: redisClient,
  host: 'localhost',
  port: 27017,
  prefix: 'stackoverflow_',
  disableTTL: true
});

// Let's configure Express to use our Redis storage to handle
// sessions as well. You'll probably want Express to handle your 
// sessions as well and share the same storage as your socket.io 
// does (i.e. for handling AJAX logins).
const session = Session({
  resave: true,
  saveUninitialized: true,
  key: 'SID', // this will be used for the session cookie identifier
  secret: 'secret key',
  store: dbSession
});
app.use(session);

// Let's initialize passport by using their middlewares, which do 
//everything pretty much automatically. (you have to configure login
// / register strategies on your own though (see reference 1)
app.use(passport.initialize());
app.use(passport.session());

// Socket.IO
const io = Socketio(server);
io.use((socket, next) => {
  session(socket.handshake, {}, next);
});
io.on('connection', socketConnectionHandler); 
// socket.io is ready; remember that ^this^ variable is just the 
// name that we gave to our own socket.io handler file (explained 
// just after this).

// Start server. This will start both socket.io and our optional 
// AJAX API in the given port.
const port = 3000; // Move this onto an environment variable, 
                   // it'll look more professional.
server.listen(port);
console.info(`  API listening on port ${port}`);
console.info(` Socket listening on port ${port}`);

sockets/index.js

Our socketConnectionHandler, I just don't like putting everything inside server.js (even though you perfectly could), especially since this file can end up containing quite a lot of code pretty quickly.

export default function connectionHandler(socket) {
  const userId = socket.handshake.session.passport &&
                 socket.handshake.session.passport.user; 
  // If the user is not logged in, you might find ^this^ 
  // socket.handshake.session.passport variable undefined.

  // Give the user a warm welcome.
  console.info(`⚡︎ New connection: ${userId}`);
  socket.emit('Grettings', `Grettings ${userId}`);

  // Handle disconnection.
  socket.on('disconnect', () => {
    if (process.env.NODE_ENV !== 'production') {
      console.info(`⚡︎ Disconnection: ${userId}`);
    }
  });
}

Extra material (client):

Just a very basic version of what the JavaScript socket.io client could be:

import io from 'socket.io-client';

const socketPath = '/socket.io'; // <- Default path.
                                 // But you could configure your server
                                // to something like /api/socket.io

const socket = io.connect('localhost:3000', { path: socketPath });
socket.on('connect', () => {
  console.info('Connected');
  socket.on('Grettings', (data) => {
    console.info(`Server gretting: ${data}`);
  });
});
socket.on('connect_error', (error) => {
  console.error(`Connection error: ${error}`);
});

References:

I just couldn't reference inside the code, so I moved it here.

1: How to set up your Passport strategies: https://scotch.io/tutorials/easy-node-authentication-setup-and-local#handling-signupregistration

score 2 · Answer 5 · answered Sep 25 '13 at 17:30

This article (http://simplapi.wordpress.com/2012/04/13/php-and-node-js-session-share-redi/) shows how to

store sessions of the HTTP server in Redis (using Predis)
get these sessions from Redis in node.js by the session id sent in a cookie

Using this code you are able to get them in socket.io, too.

var io = require('socket.io').listen(8081);
var cookie = require('cookie');
var redis = require('redis'), client = redis.createClient();
io.sockets.on('connection', function (socket) {
    var cookies = cookie.parse(socket.handshake.headers['cookie']);
    console.log(cookies.PHPSESSID);
    client.get('sessions/' + cookies.PHPSESSID, function(err, reply) {
        console.log(JSON.parse(reply));
    });
});

score 2 · Answer 6 · edited Sep 25 '20 at 15:51

2

use session and Redis between c/s

Server side

io.use(function(socket, next) {
    // get here session id 
    console.log(socket.handshake.headers.cookie); and match from redis session data
    next();
});

edited Sep 25 '20 at 15:51

Giorgi Gvimradze

1,714
1
17
34

answered Jul 18 '15 at 13:57

onplanner

41
2

Looks like if you just plug in the same code you are using to validate your Node.js endpoints(but you'll have to tweak any parts you are handling the request object) you could just reuse your token for your routes. – Nick Pineda Apr 17 '16 at 23:29

score -6 · Answer 7 · answered May 05 '12 at 12:29

-6

this should do it

//server side

io.sockets.on('connection', function (con) {
  console.log(con.id)
})

//client side

var io = io.connect('http://...')

console.log(io.sessionid)

answered May 05 '12 at 12:29

dominic

571
4
7

1

io.socket.sessionid in my case – ZiTAL May 14 '12 at 16:12
9

This isn't even an attempt at an answer. This is not authentication this is simply making a connection. – Nov 28 '14 at 19:44

Socket.IO Authentication

7 Answers7

server.js

sockets/index.js

Extra material (client):

References:

Linked

Related