We are considering developing an application using "Rooms" in the Node.js library "Socket.IO".
When there are multiple Rooms IDs are assigned to identify the Rooms to which the sockets belong, but we believe that there is a danger of IDs being leaked through methods such as "session hijacking" and communications being hijacked.
Is there a way to use "Rooms" while ensuring security?
Reference URL https://socket.io/docs/v3/rooms/
Rooms are a server-only data structure. Clients do not have any access to the concept of rooms. No amount of session hijacking gives any client direct access to a room.
So, your server controls all access to rooms. The data exists only in your server's memory. The security of that data will be entirely up to the security of your server.
Now, presumably your server accesses the rooms in response to messages from your clients so you do have to have a safe and secure design for the commands that come from your clients. Since you've not provided any information on that at all, we can't really comment on it, but this is really independent of the rooms concept - it's basic security of your app design.
One note: A given socket's internal socket.id is known to the client itself - in other words, it knows its own socket.id. No other client's ids are ever shared by socket.io with any other client. But, even if someone else would steal that socket.id somehow, there's nothing they can natively do with it via socket.io as there is no direct socket.io client access to rooms at all, even if you have a socket.id.
