daquirm / websocket-challenge Goto Github PK

Token/session-based authentication needs a more secure design

Review tests and remove exists checks where they make no sense 😾

Logging format should be improved for the sake of readability and easier parsing/querying.

Message handling logic should be resistant to excessive incoming data and prevent log flooding, authentication failures and unnecessary processing.

Create challenge live stats aggregation functionality, back-end endpoint and page view
Perfect for running WSC lives in bars 🍻

Challenge service should be deployment-ready to enable continuous websocket competitions or for demonstration purposes. 🏆

Make resources that challenge participants should not be able to obtain in any way other than completing the challenge configurable so that they are defined upon challenge start on the server machine (that participants have no access to) or encrypt them to prevent anyone from accessing them directly. This feature will allow to use this repo and all its information for the participants' benefit.

Whoa, that was a long write indeed 😅

Throw assertions are written in an ambiguous way so compiler actually creates a wrapper function around method calls which renders the assertions useless, e.g.

-> participant.update_state().should.throw Error

becomes

function() {
        return participant.update_state().should["throw"](Error);
};

which is not quite what's expected 😕

Token should not be checked for every message with copy-and-pasted code, this has to be DRYed out.