Sending Private Message ( Socket.IO )

user_12393282 0
Viewed 74

In many Posts or Articles.I often saw something like that.

Client-Side :

 socket.emit("shhh!Secrets", {
  To : "AlexId",
  Message : "Hello World!"
 })

Server-Side: 

 socket.on("shhh!Secrets", (Send) => {
  io.in(Send.TO).emit("SO...Secrets", Send.Message)
 })

Whatever it is socketId , Specific user socketObj or room base .

What If I change Client Source code and change with others room or socketId then my crazy message will saved to others chat timeline...

socket.io
2 Answers

First Method

Socket.IO is stateful. So this Smart Socket will not forget who you are in every event call.

lets say user want to join room001
So when Joining a socket to a specific Room,Save RoomId To socket.roomId = "room001"

Then use io.in(socket.roomId).emit("SO...Secrets", "message")

Second Method

Never give a change a client directly send message to specific room.

Server-Side: 
  
 socket.on("shhh!Secrets", (Send) => {
  // Send message only if the user already joined to this Room
  if (Send instanceof Object && socket.rooms[Send.TO] === Send.TO) 
    io.in(Send.TO).emit("SO...Secrets", Send.Message);
 })
user_127503990

Mohammed, of course you can change your client code, but you need to know real userId (AlexId in your example), and it is usually uuid, that is not easy to get... So there is very low chance to do that.

By the way, usually in articles use very simple examples and do not mention security aspects, so be careful with it!

user_56061560
Related