I've recently set up a nodejs chat server, the chat client is served by a php server. When users log in, their sessions will be stored in mysql of the php server, and a login cookie will append to browser.
I want to restrict users that only logged in users are able to chat. What is the best practice to archieve that ?
My quick thought:
When the chat client loaded, if user logged in, I'll send the login cookie information to nodejs verver via socket. Then create a nodejs session. When user chat, the message together with cookie information will be sent to nodejs server via socket. If the cookie information does not match the nodejs session, the message will not be broadcasted and client socket will be disconected.
A websocket is a permanent open connection. You only need to autheticate once when you connect to the websocket.
Simply send your login cookie to node.js once and store it on the server with a reference to the socket connection. Then only handle messages from authenticated users and only broadcast to authenticated users.
The problem is that client side users can easily fake this cookie as node does not talk to php to ensure that it's a valid login cookie.
An example using now.
warning pseudo code
// server.js
everyone.now.joinChat = function(cookie) {
chat.add(this, cookie);
}
everyone.now.serverMessage = function(message) {
if (chat.hasUser(this)) {
chat.broadcast(message);
}
}
chat = (function() {
var users = [];
return {
"add": function(client) {
users.push(client);
},
"hasUser": function(client) {
return users.some(function(user) {
return user === client;
});
},
"broadcast": function(message) {
users.each(function(user) {
user.clientMessage(message);
});
}
}
}());
// client.js
$(function() {
now.joinChat($.cookie("login"));
$("#send").click(function() {
now.serverMessage($(this).data("message"));
});
now.clientMessage = function(message) {
$("#messages").append($("<span></span>").text(message));
}
});
This is the answer i'm looking for nodeJS - How to create and read session with express
Related
I am trying to use Socket.IO in Node.js, and am trying to allow the server to give an identity to each of the Socket.IO clients. As the socket code is outside the scope of the http server code, it doesn't have easy access to the request information sent, so I'm assuming it will need to be sent up during the connection. What is the best way to
1) get the information to the server about who is connecting via Socket.IO
2) authenticate who they say they are (I'm currently using Express, if that makes things any easier)
Use connect-redis and have redis as your session store for all authenticated users. Make sure on authentication you send the key (normally req.sessionID) to the client. Have the client store this key in a cookie.
On socket connect (or anytime later) fetch this key from the cookie and send it back to the server. Fetch the session information in redis using this key. (GET key)
Eg:
Server side (with redis as session store):
req.session.regenerate...
res.send({rediskey: req.sessionID});
Client side:
//store the key in a cookie
SetCookie('rediskey', <%= rediskey %>); //http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx
//then when socket is connected, fetch the rediskey from the document.cookie and send it back to server
var socket = new io.Socket();
socket.on('connect', function() {
var rediskey = GetCookie('rediskey'); //http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx
socket.send({rediskey: rediskey});
});
Server side:
//in io.on('connection')
io.on('connection', function(client) {
client.on('message', function(message) {
if(message.rediskey) {
//fetch session info from redis
redisclient.get(message.rediskey, function(e, c) {
client.user_logged_in = c.username;
});
}
});
});
I also liked the way pusherapp does private channels.
A unique socket id is generated and
sent to the browser by Pusher. This is
sent to your application (1) via an
AJAX request which authorizes the user
to access the channel against your
existing authentication system. If
successful your application returns an
authorization string to the browser
signed with you Pusher secret. This is
sent to Pusher over the WebSocket,
which completes the authorization (2)
if the authorization string matches.
Because also socket.io has unique socket_id for every socket.
socket.on('connect', function() {
console.log(socket.transport.sessionid);
});
They used signed authorization strings to authorize users.
I haven't yet mirrored this to socket.io, but I think it could be pretty interesting concept.
I know this is bit old, but for future readers in addition to the approach of parsing cookie and retrieving the session from the storage (eg. passport.socketio ) you might also consider a token based approach.
In this example I use JSON Web Tokens which are pretty standard. You have to give to the client page the token, in this example imagine an authentication endpoint that returns JWT:
var jwt = require('jsonwebtoken');
// other requires
app.post('/login', function (req, res) {
// TODO: validate the actual user user
var profile = {
first_name: 'John',
last_name: 'Doe',
email: 'john#doe.com',
id: 123
};
// we are sending the profile in the token
var token = jwt.sign(profile, jwtSecret, { expiresInMinutes: 60*5 });
res.json({token: token});
});
Now, your socket.io server can be configured as follows:
var socketioJwt = require('socketio-jwt');
var sio = socketIo.listen(server);
sio.set('authorization', socketioJwt.authorize({
secret: jwtSecret,
handshake: true
}));
sio.sockets
.on('connection', function (socket) {
console.log(socket.handshake.decoded_token.email, 'has joined');
//socket.on('event');
});
The socket.io-jwt middleware expects the token in a query string, so from the client you only have to attach it when connecting:
var socket = io.connect('', {
query: 'token=' + token
});
I wrote a more detailed explanation about this method and cookies here.
Here is my attempt to have the following working:
express: 4.14
socket.io: 1.5
passport (using sessions): 0.3
redis: 2.6 (Really fast data structure to handle sessions; but you can use others like MongoDB too. However, I encourage you to use this for session data + MongoDB to store other persistent data like Users)
Since you might want to add some API requests as well, we'll also use http package to have both HTTP and Web socket working in the same port.
server.js
The following extract only includes everything you need to set the previous technologies up. You can see the complete server.js version which I used in one of my projects here.
import http from 'http';
import express from 'express';
import passport from 'passport';
import { createClient as createRedisClient } from 'redis';
import connectRedis from 'connect-redis';
import Socketio from 'socket.io';
// Your own socket handler file, it's optional. Explained below.
import socketConnectionHandler from './sockets';
// Configuration about your Redis session data structure.
const redisClient = createRedisClient();
const RedisStore = connectRedis(Session);
const dbSession = new RedisStore({
client: redisClient,
host: 'localhost',
port: 27017,
prefix: 'stackoverflow_',
disableTTL: true
});
// Let's configure Express to use our Redis storage to handle
// sessions as well. You'll probably want Express to handle your
// sessions as well and share the same storage as your socket.io
// does (i.e. for handling AJAX logins).
const session = Session({
resave: true,
saveUninitialized: true,
key: 'SID', // this will be used for the session cookie identifier
secret: 'secret key',
store: dbSession
});
app.use(session);
// Let's initialize passport by using their middlewares, which do
//everything pretty much automatically. (you have to configure login
// / register strategies on your own though (see reference 1)
app.use(passport.initialize());
app.use(passport.session());
// Socket.IO
const io = Socketio(server);
io.use((socket, next) => {
session(socket.handshake, {}, next);
});
io.on('connection', socketConnectionHandler);
// socket.io is ready; remember that ^this^ variable is just the
// name that we gave to our own socket.io handler file (explained
// just after this).
// Start server. This will start both socket.io and our optional
// AJAX API in the given port.
const port = 3000; // Move this onto an environment variable,
// it'll look more professional.
server.listen(port);
console.info(`🌐 API listening on port ${port}`);
console.info(`🗲 Socket listening on port ${port}`);
sockets/index.js
Our socketConnectionHandler, I just don't like putting everything inside server.js (even though you perfectly could), especially since this file can end up containing quite a lot of code pretty quickly.
export default function connectionHandler(socket) {
const userId = socket.handshake.session.passport &&
socket.handshake.session.passport.user;
// If the user is not logged in, you might find ^this^
// socket.handshake.session.passport variable undefined.
// Give the user a warm welcome.
console.info(`⚡︎ New connection: ${userId}`);
socket.emit('Grettings', `Grettings ${userId}`);
// Handle disconnection.
socket.on('disconnect', () => {
if (process.env.NODE_ENV !== 'production') {
console.info(`⚡︎ Disconnection: ${userId}`);
}
});
}
Extra material (client):
Just a very basic version of what the JavaScript socket.io client could be:
import io from 'socket.io-client';
const socketPath = '/socket.io'; // <- Default path.
// But you could configure your server
// to something like /api/socket.io
const socket = io.connect('localhost:3000', { path: socketPath });
socket.on('connect', () => {
console.info('Connected');
socket.on('Grettings', (data) => {
console.info(`Server gretting: ${data}`);
});
});
socket.on('connect_error', (error) => {
console.error(`Connection error: ${error}`);
});
References:
I just couldn't reference inside the code, so I moved it here.
1: How to set up your Passport strategies: https://scotch.io/tutorials/easy-node-authentication-setup-and-local#handling-signupregistration
This article (http://simplapi.wordpress.com/2012/04/13/php-and-node-js-session-share-redi/) shows how to
store sessions of the HTTP server in Redis (using Predis)
get these sessions from Redis in node.js by the session id sent in a cookie
Using this code you are able to get them in socket.io, too.
var io = require('socket.io').listen(8081);
var cookie = require('cookie');
var redis = require('redis'), client = redis.createClient();
io.sockets.on('connection', function (socket) {
var cookies = cookie.parse(socket.handshake.headers['cookie']);
console.log(cookies.PHPSESSID);
client.get('sessions/' + cookies.PHPSESSID, function(err, reply) {
console.log(JSON.parse(reply));
});
});
use session and Redis between c/s
Server side
io.use(function(socket, next) {
// get here session id
console.log(socket.handshake.headers.cookie); and match from redis session data
next();
});
this should do it
//server side
io.sockets.on('connection', function (con) {
console.log(con.id)
})
//client side
var io = io.connect('http://...')
console.log(io.sessionid)
I Currently have a php website working. Here i can keep and use any session data to keep track of my user. however if i simply connect to my node.js game from this website using a simple hyper link such as...
<a href="http://localhost:8080">
This works and i do connect to my game running on a local host on that port here is the coded for setting up the node.js game.
const http = require('http');
const express = require('express');
const socketio = require('socket.io');
const TDSGame = require('./../tds-game');
const { log } = require('console');
const app = express();
// path for our client files
const clientPath = `${__dirname}/../client`;
console.log(`Serving static from ${clientPath}`);
// for static middleware from express
app.use(express.static(clientPath));
const server = http.createServer(app);
const io = socketio(server);
var waitingPlayers = [];
io.on('connection', (sock) => {
if(waitingPlayers.length == 3){
waitingPlayers.push(sock);
new TDSGame(waitingPlayers);
waitingPlayers = [];
}
else{
waitingPlayers.push(sock);
sock.emit('message', 'Waiting for opponent');
}
sock.on('message', (text)=>{
// io.emmit everyone connected to the server receives the message
io.emit('message', text);
});
});
server.on('error', (err)=>{
console.log('Server Error', err);
});
server.listen(8080, ()=>{
console.log('TDS started on 8080');
});
What would be a good way of passing the players i dunno hash and
username or something. to the the game so on connection i can get
these variables and check to see if my player exists in the database?
if so then pass these players and sockets to the game logic?
I am struggling any help would be much appreciated thank you :)
you can add extra params to the socket connection URL "http://localhost:8080?foo=bar&hi=hello" and through that, you can get the data when the socket-clint connects ( io.on('connection') event ).
And you can delete the data from the array (
waitingPlayers ) when it disconnects. Through this way you can manage the connections.
I do use the socket.io for my chat-app where I use redis instead of Array to store the connection id to send and receive messages.
In my web app (symfony3) I try to integrate a real time notification system.
I choose to done this with this configuration :
server NodeJS
server redis
socket.io
socket.io-php-emitter (php adaptater for emit notification directly from php)
app.js (server node)
var app = require('express')();
var http = require('http').Server(app);
var server = require('http').createServer();
var io = require('socket.io').listen(server);
var redis = require('socket.io-redis');
io.sockets.on('connection', function (socket) {
console.log('user connected!');
});
io.adapter(redis({ host: 'localhost', port: 6379 }));
server.listen(8081, 'myhost');
test controller
public function testAction(Request $request)
{
$notification = 'A message has been received by the server!<br />'
$form = $this->createFormBuilder()->getForm();
$form->handleRequest($request);
if ($form->isValid()) {
$redis = new \Redis();
$redis->connect('127.0.0.1', '6379');
$emitter = new SocketIO\Emitter($redis);
$emitter->emit('notification', $notification);
$response = new JsonResponse();
$response->setData(array(
'notification' => $notification
));
return $response;
}
return $this->render('#PMPlatform/Test/test.html.twig', array(
'form' => $form->createView()
));
}
client view
$(document).ready(function() {
// Getting socket
var socket = io('http://myhost:8081');
// Listening on notification from server
socket.on('notification', function (data) {
$('.server').append('qsfdqsfdqsdfqsfdqsfd');
});
// Listener on form submit event
$(document).on('submit', '.form', function(e) {
e.preventDefault();
$.ajax({
type: 'POST',
url: '/app_dev.php/test',
data: $(this).serialize(),
success : function(response){
$('.client').append('A message has been sent to server from this client!<br />');
},
error : function(response){
console.log('Something went wrong.');
},
cache: false
});
return false;
});
});
Ok this simple test works fine : when I submit the form from the proper view, a notification is displayed to all client which are on this page.
1- Now I want to one user be able to send a notification only to one another user (when a user comment a post, the author of the post recieved a notification). How I can do this ?
2- If the author is not connected, How I can to save the notification to show it when the author connects back ?
For your first question, in the server you maintain in some way, redis for example, a list of all your connected clients by their sockets. But, the key thing here is to pass an id of the user when it connects to the server. Now you have your users in your socket.io server perfectly identified by their id.
io.sockets.on('connection', function (socket) {
console.log(socket);
});
If you look at the socket object that comes with a connection, there you will have the id of the user that just got connected.
Then when you want to send a notfiication to that user you just have to search in redis for the corresponding socket to the user id you want to send notification. When you instantiate your emitter $emitter = new SocketIO\Emitter($redis); you will have to search in redis for that particular socket - search in redis by user id -
For the second question I won't go into websockets for this feature. Every time a user connects you will have to search in database if he has any pending notification, and send to him. This can be done for a small amount of users without incurring in a heavy computational usage, but this does not scale.
For this purpose I will:
Search in redis for the connected user
If not connected, save into database the new notification.
When the user connects again, make a standard HTTP request to the API and send to him all the pending notifications, handling them and making necessary changes.
Hope it helps!
EDIT
I forgot to explain how you pass data on the connection. On the client just do: var socket = io('http://216.157.91.131:8080/', { userId: "myUserId" });. Easy, isn't it?
I was implementing FB social login in website based on PHP. I checked FB website and found it easy to implement. Below is the approach i have followed and i am not sure that i have any security issues here.
I have used Facebook JS SDK approach.
and is as follows:
var appID = 'xxxxxxxxxxxxxxx';
window.fbAsyncInit = function() {
FB.init({
appId : appID, // App ID
channelUrl : '',
status : true,
cookie : true,
xfbml : true,
});
FB.getLoginStatus(function(response) {
if (response.status === 'connected') {
// connected
FB.api('/me?fields=id,name,email,permissions', function(response) {
//alert('Good to see you, ' + response.name + '.');
});
}else{
}
});
};
function login() {
if( navigator.userAgent.match('CriOS') ){
}
else{
FB.login(function(response) {
if (response.authResponse) {
replace_login();
} else {
// cancelled
alert('User cancelled login or did not fully authorize.');
}
},{scope: 'email,public_profile,user_friends'});
}
}
function replace_login(){
FB.api('/me?fields=id,name,email', function(response) {
$.ajax({
url: "s-account",
type: 'POST',
data: response,
dataType: 'json',
beforeSend: function(){
$("#signin_fb").button('loading');
},
success: function(data) {
$("#signin_fb").button('reset');
window.location.reload();
},
error: function(){
$("#signin_fb").button('reset');
}
});
});
}
And in PHP at server side, i am storing user detail like social_id, name and email in database through ajax call and if DB operation is successful then i am setting Session Variable in my website with username and email and user is logged in successfully.
For logout, i am using my own logout function to destroy Website user session and user is successfully logged out.
Now, where is the security risk? because if user is logged out and then try to login again JS SDK shall get a new Access Token through new response.
This whole authentication process boils down to the ajax call to s-account. You're sending name and email from FB.api() to your back end application in a POST request and as you didn't mention, I presume you're not verifying the access token with these details on the server side and you're simply making a session based on these details.
The security issue
Now, the security issue is that you're using a client side authentication on the server side. A user can simply generate a POST request to s-account with a fake response like Facebook with any username and email address and your PHP application will authenticate the user and make a valid session without verifying if the details are coming from a legit source. Your authentication is completely broken at this stage because a malicious user can login with any account by generating a simple POST request to s-account with any email and username.
How to fix
Facebook provides an end-point in the graph API which validates an access token and returns the details of the user associated with this access token. From the Docs:
This endpoint returns metadata about a given access token. This
includes data such as the user for which the token was issued, whether
the token is still valid, when it expires, and what permissions the
app has for the given user.
The Fb.Login() will generate the access token as response.authResponse.accessToken and userId as response.authResponse.userID. You need to send this accessToken & userID along with the other user details in your ajax call to s-account and then use the following API end-point to validate if the details are legit.
curl -X GET "https://graph.facebook.com/v2.6/debug_token?input_token=USER_ACCESS_TOKEN_FROM_AJAX_CALL&access_token=YOUR_APP_ACCESS_TOKEN"
If the the access token is valid, you'll get the following response with the userID for which this token was issued.
{
"data": {
"app_id": "YOUR_APP_ID",
"application": "YOUR_APP_NAME",
"expires_at": 1462777200,
"is_valid": true,
"scopes": [
"email",
"manage_pages",
"pages_messaging",
"pages_messaging_phone_number",
"public_profile"
],
"user_id": "THE_USER_ID_ASSOCIATED_WITH_THE_TOKEN"
}
}
Now you can compare this userID with the userID you received in the ajax call and check if the details are legit.
How to get your APP_ACCESS_TOKEN
To debug the user access token using the debug_token API, you need to generate your APP access token on the server side using the following API end-point.
curl -X GET "https://graph.facebook.com/v2.6/oauth/access_token?client_id=YOUR_APP_ID&client_secret=YOUR_APP_SECRET&grant_type=client_credentials"
This will return your app access token in response.
{
"access_token": "YOUR_APP_ACCESS_TOKEN_HERE",
"token_type": "bearer"
}
I'm having some troubles with the Facebook API, I am requesting permission for some information of the user by Javascript:
FB.login(function (response) {
if (response.authResponse) {
// authorized
} else {
// canceled
}
}, {scope: 'email,user_birthday,user_location'});
Now I want to get the user's information (when he is authorized) by PHP:
$facebookUser = json_decode(file_get_contents('https://graph.facebook.com/' . $this->data['userid'] . '?access_token=' . $this->oathtoken . '&fields=id,name,location,gender,email,picture,birthday,link'));
All working great, except that the API is not giving the user's birthday back. Even when I set my birthday privacy settings on public it won't show up.
So:
echo $facebookUser['birthday']; // Gives an error, since this key does not exists
Does somebody have an idea how to fix this?
You are logged in on the client side but php is executed on the server side so you receive only the basic information of an user object.
If you logged in on the server side and have the permissions so you can get the birthday simply with:
echo $facebookUser['birthday'];
Most probably you didn't receive approval to request user_birthday from FB.
You can't get user_birthday unless FB reviews your FB app.
Only the following permissions may be requested without review: public_profile, user_friends and email
(See: https://developers.facebook.com/docs/facebook-login/review/what-is-login-review)
Without review you can request only age_range, but not user_birthday
FB.login(function (response) {
var user_birthday = response.user_birthday;
console.log(user_birthday);
if (response.authResponse) {
} else {
// canceled
}
}, {scope: 'email,user_birthday,user_location'});
why don't you use serverside auth if you would like get FB info in server side?
if you are ok with clientside authentication, above should work.