Authentication with socket.io
Unanswered
Jesse posted this in #help-forum
JesseOP
Does anybody know the best way to authenticate websockets with socket.io
Because I've got a middleware checking if you have the right token
However this token is visible in the network tab
Because I've got a middleware checking if you have the right token
However this token is visible in the network tab
8 Replies
Peterbald
Hi
You can use JWT
with your own secret key
So what kind of token are you currently using?
JesseOP
The problem is that when I send the secret key it's visible to the client and therefore people will be able to find it and then abuse the web sockets.
But I'll give it a shot.
@Jesse The problem is that when I send the secret key it's visible to the client and therefore people will be able to find it and then abuse the web sockets.
connect to socketio > when user submits the form, send that data through socket > perform all the stuff in backend > return token and save that as a cookie
@Jesse The problem is that when I send the secret key it's visible to the client and therefore people will be able to find it and then abuse the web sockets.
Peterbald
You don't need to send the secret key. You have to verify if the token is valid on only SERVER