Enhancing Security in a now.js/socket.io chat

Problem

A chat with nowjs or socket.io is one of the easiest exercises you can perform with them. I want to implement a multi-room chat (with a non-fixed number of rooms and logged users), using nowjs' Group objects.

I've not worked with WebSockets directly, yet, and I want to know what security concerns are there. For example, how often do I have to check for authentication?

Is it possible for an attacker to "hijack" a socket.io connection and how can I prevent it?

What other security traps are there to be concerned?

Problem courtesy of: Lanbo

Solution

Man-in-the-middle is certainly a consideration. The biggest security issue, though, would be XSS.

This useful SO thread suggests:

  1. socket.io 0.8 has referrer verification built in
  2. if chat is from known origin, block superfluous connections at the firewall

This very informative article suggests:

  1. don't trust the client
  2. use SSL encryption
  3. check the origin
  4. prevent XSS (sanitize client input!)
  5. don't assume it's a browser

This useful thread says to set secure:true on socket.io.connect(...)

I'd recommend taking all those suggestions :)

Solution courtesy of: Kato

Discussion

There is currently no discussion for this recipe.

This recipe can be found in it's original form on Stack Over Flow.