Socket.io Security Issues

Question

I'm wondering how I could secure my socket.io connection to the server from th following.

Security Issues:

What would stop malicious users from connecting to the socket server via client side code?

Example:

OUTSIDE DOMAIN REQUEST var socket = io.connect('http://Mydomain', {port: 4000});

Users can seemingly create thousands of concurrent connections just by opening a different browser window.

How can I prevent these issues?

look at https://github.com/LearnBoost/socket.io/wiki/Authorizing and inspect user's address (ip) and header request via socket.handshake or global authorize — King Friday, Oct 01 '12 at 00:31

score 6 · Accepted Answer · edited Mar 27 '16 at 15:01

6

You should be able to check serverside that the HTTP referrer is correct. Check the socket.io spec for info on both http referring as well as handshaking.

https://github.com/socketio/socket.io-protocol

Also 0.8 has referrer verification. Havent used it before, but this may be a place to start looking:

https://github.com/LearnBoost/socket.io/pull/481

edited Mar 27 '16 at 15:01

Musa Haidari

2,109
5
30
53

answered Sep 17 '11 at 01:00

wesbos

25,839
30
106
143

Thanks, but what if there are multiple connections from the same user? – Trevor Sep 18 '11 at 00:19

score 0 · Answer 2 · answered Sep 16 '11 at 23:38

0

Well, if your (real) clients are coming from a well know location, you'd probably want to to block everyone else at the firewall level. Assuming your service is available to everyone, you can probably look into client-server handshake mechanism.

answered Sep 16 '11 at 23:38

A.RG

21
2

Socket.io Security Issues

2 Answers2

Linked