DefaultSubscriptionRegistry and its protected methods

user_18300670 0
Viewed 54

I am trying to implement a WebSocket feature with STOMP in my SpringBoot application. So far, this is going quite alright, but I'm running into one issue.

Unsubscribing from a topic seems to always be done from the browser's side. However, using @DestinationVariable I can create a number of topics (e.g. with the path /{game_id}/chat), and I need a security feature on the server's side.

Because messages are authorized, I am able to check whether the logged user actually has access to {game_id}. If they don't, the subscription should end (not the WebSocket connection!). To do this, I autowired DefaultSubscriptionRegistry to delete the subscription from the list, but this method is apparently protected. I now find myself not knowing how to delete this subscription (which is managed by the simple broker Spring provides) from inside of Spring.

I guess another way to do this is by mocking an unsubscribe message from the browser and having the MessageHandler handle it. But that gives its own challenges, mainly obtaining the ApplicationContext of the simple broker (that I did not personally edit).

Has anyone faced this challenge before? Are there good workarounds/alternatives to unsubscribe from the server side?

stomp spring-websocket spring-security spring websocket
1 Answers

Rossen has given an answer on GitHub that I believe will help with this.

Essentially, the approach is to register a ChannelInterceptor that creates a mock unsubscribe message:

@Override
public Message<?> beforeHandle(Message<?> message, MessageChannel channel, MessageHandler handler) {
    StompHeaderAccessor headers = 
        StompHeaderAccessor.create(StompCommand.UNSUBSCRIBE);
    // ... add headers
    Message<?> unsubscribe = MessageBuilder
       .withPayload(new byte[0]).setHeaders(headers).build();
    messageHandler.handleMessage(unsubscribe);
    return message;
}
user_22433240
Related