使用環回令牌來驗證socket.io

Question

我正在使用loopback 2.0和socket.io 1.0.6。

我想使用環回認證方法來認證socket.io。

我發現了在loopback/lib/middleware/token.js中驗證用戶的方法。 https://github.com/strongloop/loopback/blob/master/lib/middleware/token.js

然後我寫象下面這樣：

var loopback = require('loopback'); 
var ioapp = module.exports = socketio; 

function socketio(server) { 
    var io = require('socket.io')(server); 

    // auth 
    io.use(function(socket, next) { 
    loopback.token()(socket.request, null, next); 
    }); 

    // listeners 
    ... 

    return io; 
}; 

但實際上，我將無法正常工作，並導致錯誤這樣。

/Users/.../project_root/node_modules/loopback/lib/models/access-token.js:201 
    id = req.param(params[i]); 
      ^
TypeError: Object #<IncomingMessage> has no method 'param' 
    at tokenIdForRequest (/Users/ksuzuki/Projects/appsocially/repo/chat-center/node_modules/loopback/lib/models/access-token.js:201:14) 
    at Function.AccessToken.findForRequest (/Users/ksuzuki/Projects/appsocially/repo/chat-center/node_modules/loopback/lib/models/access-token.js:123:12) 
    at /Users/ksuzuki/Projects/appsocially/repo/chat-center/node_modules/loopback/lib/middleware/token.js:53:16 
    at Array.0 (/Users/ksuzuki/Projects/appsocially/repo/chat-center/server/socket.js:15:28) 
    at run (/Users/ksuzuki/Projects/appsocially/repo/chat-center/node_modules/socket.io/lib/namespace.js:114:11) 
    at Namespace.run (/Users/ksuzuki/Projects/appsocially/repo/chat-center/node_modules/socket.io/lib/namespace.js:126:3) 
    at Namespace.add (/Users/ksuzuki/Projects/appsocially/repo/chat-center/node_modules/socket.io/lib/namespace.js:155:8) 
    at Client.connect (/Users/ksuzuki/Projects/appsocially/repo/chat-center/node_modules/socket.io/lib/client.js:67:20) 
    at Server.onconnection (/Users/ksuzuki/Projects/appsocially/repo/chat-center/node_modules/socket.io/lib/index.js:309:10) 
    at Server.EventEmitter.emit (events.js:95:17) 

我想這是因爲我把錯誤的對象類型傳遞給loopback.token（）方法。

Answer 1

嗯，我相信Loopback標記是建立用於快速請求對象。在最新版本（2.x）中，如果您覆蓋AccessToken.findForRequest並自行實施它，則可以使用它。

但還有另一種方法來這裏面是覆蓋在the official documentation：

基本上它建議使用socketio-auth（其中「提供了鉤子，以實現socket.io驗證不使用查詢字符串來發送憑據，這是不是一個很好的安全性練習「）並直接使用AccessToken模型。

我把代碼在這裏用簡化的一點點：

在服務器端：

app.io = require('socket.io')(app.start()); 
require('socketio-auth')(app.io, { 
    authenticate: function (socket, value, callback) { 

     var AccessToken = app.models.AccessToken; 
     //get credentials sent by the client 
     var token = AccessToken.count({ 
     userId: value.userId, 
     id: value.id, 
     }, callback); 
    } 
}); 

在客戶端：

socket.on('connect', function() { 
    // You should have retrieved tokenId/userId by calling user.login and 
    // saving it in cookies or localStorage. 
    socket.emit('authentication', {id: tokenId, userId: userId }); 
});