One of the reasons I switched from REST to socket.io is because the latter is a stateless communication, I am finding myself that if I have to add a lot of Tokens for every emit this bloats the whole communication a lot.
Is this the main security standard for chat communication with socket.io?
So lets say for an app like Grindr the best approach would be something like JWT with every emmit? through passport?
Cheers
The way I handle it is to authenticate once on sign-in, and create an authentication token server-side. On the server, I map the token to the user details, and attach only the username to the socket object. I send the token to the client only once, as a response to sign-in. Then any event that you'd want to verify the user's identity for (read: almost all events) you send the token with it and verify the user server-side based on the token and the username attached to the socket object receiving the message.
Note that while JWT is certainly one standard, using this approach, you don't need any particular token format. You just need a unique ID of some sort as a token, so even a 5-character random (but unique!) token should be fine, leaving not much extra bloat on your messages.
