CODEWITHSUNDEEP
node.jsexpresscookiessocket.ioredux
Leopold Joy
Leopold Joy

Reputation: 4660

Is this a sound authentication scheme for Node.js and Socket.io?

I am trying to setup a user login system with Node.js (Express), Socket.io, and Redux/ReactJS. This is the approach I'm taking:

  1. The user connects through Socket.io as soon as he/she gets to the web app.
  2. Through socketio-auth the user is required to authenticate and passes their username and password to the server.
  3. Then, using socket.io-express-session, like in this example, I set a cookie with the user's username and password, so that every time they come back to the website they can be re-authenticated through socketio-auth. (I realize I could probably save a unique token in the cookie instead, would this be better?)
  4. On the server, upon authentication, I just save their details with their socketId to the Redux store for use with every Socket.io request while the session lasts.

Assuming this is all done over SSL, is this safe? What changes would you suggest? I'm trying to make it as simple as possible yet still very safe.

Upvotes: 2

Views: 200

Answers (1)

Mr.Pe
Mr.Pe

Reputation: 739

It seems like point 3, with Local Storage, is the best way to go for now.

See someone else interrogation: https://github.com/hueniverse/hawk/issues/138#issuecomment-196989520

Upvotes: 0

Related Questions