A chat with nowjs or socket.io is one of the easiest exercises you can perform with them. I want to implement a multi-room chat (with a non-fixed number of rooms and logged users), using nowjs' Group objects.
I've not worked with WebSockets directly, yet, and I want to know what security concerns are there. For example, how often do I have to check for authentication?
Is it possible for an attacker to "hijack" a socket.io connection and how can I prevent it?
What other security traps are there to be concerned?
Man-in-the-middle is certainly a consideration. The biggest security issue, though, would be XSS.
This useful SO thread suggests:
- socket.io 0.8 has referrer verification built in
- if chat is from known origin, block superfluous connections at the firewall
This very informative article suggests:
- don't trust the client
- use SSL encryption
- check the origin
- prevent XSS (sanitize client input!)
- don't assume it's a browser
This useful thread says to set secure:true on socket.io.connect(...)
I'd recommend taking all those suggestions :)
There is currently no discussion for this recipe.
This recipe can be found in it's original form on Stack Over Flow.