Comments (9)
Hooking in authorization would be more challenging then initially thought. The only framework that provides decent authorization is socket.io. It has a special function that we can leverage for that. All other frameworks have no additional hooks for this. I've added a special authorization
hook in Engine.IO but it got rejected. So the only decent way to do validation would be to validate every single incoming request or figure out each handshake URL pattern and only run a validator against that.
from primus.
@3rd-Eden Hmm ok, I get what you mean. There would essentially need to be a custom hook for each transformer for the way it connects. Doing this cleanly will be interesting ;). I'll get myself more versed with the code and see if I can be of any assistance.
from primus.
What about validating the actual http request that gets the primus.js file, there could be a middleware (hook) that can do the authorization/authentication beforehand?
from primus.
@cayasso I'm assuming that not everybody will serving the primus.js
from the server but upload it a content delivery network etc.
from primus.
Interesting. I'm currently working on simple implementation that upon a connection
event sends a request to a web server for authentication and then emits an authenticated
event to the client. I would rather rely on the open
event instead after a successful hook though :) is it possible to keep a websocket on a pending state while this hook is being processed?
from primus.
@ruimarinho I guess can just halt the response when a upgrade
event comes in so it's not passed in to the real-time systems.
from primus.
Would that be something to consider? I don't have enough experience with websockets to know if that is an appropriate solution or not. In theory, it looks more correct than accepting the connection and then closing it in response to a failed authentication request.
from primus.
For those who are interested, i've started a basic-auth
branch which introduces a authorize
function that will be called on every incoming request.
Feel free to follow the progress here; https://github.com/3rd-Eden/primus/compare/basic-auth it currently completely kills the client when the request is unauthorized.
from primus.
Fixed in master
from primus.
Related Issues (20)
- Missing dependencies for parser: "json" HOT 1
- Primus->diagnostics->storage-engine forces --unsafe-perm in global install HOT 4
- update documentation to be more explicit around createSocket
- Problem using proxy with primus client side
- Nativescript support HOT 1
- Does the primus web client work with a non-primus websocket server? HOT 4
- How can I know if a connection has been upgraded or not? HOT 4
- import primus client in client JS
- Getting response headers while polling HOT 3
- public connections and connected HOT 1
- Consider to rewrite without prototype pollution? HOT 11
- Primus with Koa and websockets transport HOT 3
- Can you please consider changing "Primus, the creator god of transformers" HOT 3
- primus doesn't accept custom path with engine.io HOT 10
- async plugins support HOT 8
- support of the new uwebsocket version
- Allow Primus instance to select version of transformer/engine library
- Server Side Events (SSE) source HOT 7
- Maximum Concurrent Connection on Primus Server HOT 2
- Consider alternative to deprecated navigator.userAgent getter. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from primus.