4

Let me explain my setup. I have multiple domain names that are all CNAME records for a main domain name, such as example.com.

example.com -> serverIP

company1.example.com -> example.com

company2.example.com -> example.com

I'm basically developing white labeled versions of our software, where the software simply detects the referrer and knows which logos and stylesheet assets to load.

So that is all well and good, however when socket.io tries to handshake to it's url that looks something like http://company1.example.com/socket.io/1/?key=123456, the request hangs in a pending state upon signing into the app. On the main domain, example.com, everything goes through just fine. The dfference is that the main domain sends in a cookie to the socket.io handshake URL whereas the company subdomains do not.

Does anyone have any ideas on how to fix this? It doesn't appear to even be reaching the server and after a few minutes the pending request returns that it could not be completed.

jrthib
  • 1,319
  • 1
  • 12
  • 17
  • 1
    What's your code to handle authorizations? I suggest to stop authorizing based on cookies and change it to using tokens. – Farid Nouri Neshat May 25 '14 at 03:10
  • I'll try removing the cookie method, however it appears as though its not even reaching the authorization stage. It's literally just hanging and not moving forward. I added `console.log` statements in my handshake and authorization code, and they don't even occur. – jrthib May 25 '14 at 03:13
  • More information: I just got a "No 'Access-Control-Allow-Origin' for the example.com/socket.io/1/ URL. Any ideas how to allow certain origins to that URL? – jrthib May 25 '14 at 03:27
  • @jrthib If you're using Express, you might look at the [cors](https://github.com/troygoode/node-cors) middleware module. – mscdex May 25 '14 at 03:53
  • Are you setting the [`origin` config property](https://github.com/LearnBoost/Socket.IO/wiki/Configuring-Socket.IO#server) of socket.io properly? Try to set it to `*:*` and see if it works or not. – Farid Nouri Neshat May 25 '14 at 03:58
  • I just finished switching over to token based authorization and all my problems magically went away. Feel free to submit an official answer if you want :) – jrthib May 25 '14 at 04:11

2 Answers2

7

I had a similar problem and found that the issue was from the JS Client I was using. I solved this by adding withCredentials: true to my connection config.

Here is how it looks

import io from "socket.io-client";

const connectionObject  = {
  ...,
  withCredentials: true,
};
socket = io("http://127.0.0.1:5000" || "", connectionObject);

This added Cookies to calls to my Socket Server.

Chidiebere
  • 1,051
  • 1
  • 13
  • 14
0

You got two choices:

  1. Don't use cookies for authentication. Use a token a based method. As soon as the client gets connected to the app, just send the authentication token. You can save the token with localstorage, and for the first time, the token can be embedded in javascript or html by your server.

    If you wonder why you shouldn't use tokens, read this from sockjs-node documentation, which implements something similar to socket.io

    Cookies are a contract between a browser and an http server, and are identified by a domain name. If a browser has a cookie set for particular domain, it will pass it as a part of all http requests to the host. But to get various transports working, SockJS uses a middleman

    an iframe hosted from target SockJS domain. That means the server will receive requests from the iframe, and not from the real domain. The domain of an iframe is the same as the SockJS domain. The problem is that any website can embed the iframe and communicate with it - and request establishing SockJS connection. Using cookies for authorisation in this scenario will result in granting full access to SockJS communication with your website from any website. This is a classic CSRF attack. Basically - cookies are not suited for SockJS model. If you want to authorise a session - provide a unique token on a page, send it as a first thing over SockJS connection and validate it on the server side. In essence, this is how cookies work.

    Also check this article as an example implementation.

    If you are still not convinced, then check choice number 2:

  2. Keep using cookies. This might not work though. Upgrade to the latest socket.io(either 0.9.x or 1.x). Using 0.9.x set the origin config property. Or on 1.x set origins server option. You can set them to *:* or *example.com:*.

    Also check this question: CORS with socket.io

Community
  • 1
  • 1
Farid Nouri Neshat
  • 29,438
  • 6
  • 74
  • 115