Thream/socketio-jwt
Archived
2
1
Fork 0
Code Issues Pull Requests Releases Activity

feat: add support for socket.io >= 3.0.0

Browse Source
This commit is contained in:
divlo
2020-12-29 03:32:28 +01:00
parent 76173f894f
commit 0e534dd8ee
16 changed files with 43 additions and 1635 deletions
Download Patch File Download Diff File Expand all files Collapse all files

139
src/__test__/authorizer.test.ts
View File

@ -1,139 +0,0 @@
import io from 'socket.io-client'
import { fixtureStart, fixtureStop } from './fixture/index'
import axios from 'axios'
describe('authorizer', () => {
describe('when the user is not logged in', () => {
beforeEach((done) => {
jest.setTimeout(15_000)
fixtureStart(done)
})
afterEach((done) => {
fixtureStop(done)
})
it('should emit error with unauthorized handshake', (done) => {
const socket = io.connect('http://localhost:9000?token=boooooo')
socket.on('error', (err: any) => {
expect(err.message).toEqual('jwt malformed')
expect(err.code).toEqual('invalid_token')
socket.close()
done()
})
})
})
describe('when the user is logged in', () => {
describe('authorizer disallows query string token when specified in startup options', () => {
let token: string = ''
beforeEach((done) => {
jest.setTimeout(15_000)
fixtureStart(
async () => {
const response = await axios.post('http://localhost:9000/login')
token = response.data.token
done()
},
{ auth_header_required: true }
)
})
afterEach((done) => {
fixtureStop(done)
})
test('auth headers are supported', (done) => {
const socket = io.connect('http://localhost:9000', {
// @ts-expect-error
extraHeaders: { Authorization: `Bearer ${token}` }
})
socket.on('connect', () => {
socket.close()
done()
})
})
test('auth token in query string is disallowed', (done) => {
const socket = io.connect('http://localhost:9000', {
query: `token=${token}`
})
socket.on('error', (err: any) => {
expect(err.message).toEqual('Server requires Authorization Header')
expect(err.code).toEqual('missing_authorization_header')
socket.close()
done()
})
})
})
describe('authorizer all auth types allowed', () => {
let token: string = ''
beforeEach((done) => {
jest.setTimeout(15_000)
fixtureStart(async () => {
const response = await axios.post('http://localhost:9000/login')
token = response.data.token
done()
})
})
afterEach((done) => {
fixtureStop(done)
})
it('auth headers are supported', (done) => {
const socket = io.connect('http://localhost:9000', {
// @ts-expect-error
extraHeaders: { Authorization: `Bearer ${token}` }
})
socket.on('connect', () => {
socket.close()
done()
})
})
it('should do the handshake and connect', (done) => {
const socket = io.connect('http://localhost:9000', {
query: `token=${token}`
})
socket.on('connect', () => {
socket.close()
done()
})
})
})
})
describe('unsigned token', () => {
const token =
'eyJhbGciOiJub25lIiwiY3R5IjoiSldUIn0.eyJuYW1lIjoiSm9obiBGb28ifQ.'
beforeEach((done) => {
jest.setTimeout(15_000)
fixtureStart(done)
})
afterEach((done) => {
fixtureStop(done)
})
it('should not do the handshake and connect', (done) => {
const socket = io.connect('http://localhost:9000', {
query: `token=${token}`
})
socket
.on('connect', () => {
socket.close()
done(new Error("this shouldn't happen"))
})
.on('error', (err: any) => {
socket.close()
expect(err.message).toEqual('jwt signature is required')
done()
})
})
})
})

57
src/__test__/fixture/index.ts
View File

@ -1,57 +0,0 @@
import express from 'express'
import jwt from 'jsonwebtoken'
import { Server as HttpServer } from 'http'
import { Server as HttpsServer } from 'https'
import socketIo, { Server as SocketIoServer } from 'socket.io'
import enableDestroy from 'server-destroy'
import { authorize } from '../../index'
interface Socket {
io: null | SocketIoServer
init: (httpServer: HttpServer | HttpsServer) => void
}
const socket: Socket = {
io: null,
init (httpServer) {
socket.io = socketIo(httpServer)
}
}
let server: HttpServer | null = null
export const fixtureStart = (done: any, optionsAuth: any = {}) => {
const options = Object.assign(
{
secret: 'aaafoo super sercret',
timeout: 1000,
handshake: true
},
optionsAuth
)
const app = express()
app.use(express.json())
app.post('/login', (_req, res) => {
const profile = {
first_name: 'John',
last_name: 'Doe',
email: 'john@doe.com',
id: 123
}
const token = jwt.sign(profile, options.secret, { expiresIn: 60 * 60 * 5 })
return res.json({ token })
})
server = app.listen(9000, done)
socket.init(server)
socket.io?.use(authorize(options))
enableDestroy(server)
}
export const fixtureStop = (callback: Function) => {
socket.io?.close()
try {
server?.destroy()
} catch (err) {}
callback()
}

367
src/index.ts
View File

@ -3,9 +3,9 @@ import { Socket } from 'socket.io'
class UnauthorizedError extends Error {
public inner: { message: string }
public data: { message: string; code: string; type: 'UnauthorizedError' }
public data: { message: string, code: string, type: 'UnauthorizedError' }
constructor(code: string, error: { message: string }) {
constructor (code: string, error: { message: string }) {
super(error.message)
this.message = error.message
this.inner = error
@ -18,341 +18,56 @@ class UnauthorizedError extends Error {
}
}
/**
* If JwtAuthOptions.secret is a function, then this is the signature of the callback function provided to that function
*/
export type JwtSecretFuncCallback = (err: Error | null, secret: string) => void
interface ExtendedError extends Error {
data?: any
}
/**
* This is a function with two args payload, and done.
*
* `request` is the original request
* `payload` is the decoded JWT payload
* `callback` is an error-first callback defined below
*/
export type JwtSecretFunc = (
request: any,
payload: any,
callback: JwtSecretFuncCallback
type SocketIOMiddleware = (
socket: Socket,
next: (err?: ExtendedError) => void
) => void
/**
* This is an object literal that contains options.
*/
export interface JwtAuthOptions {
auth_header_required?: boolean
secret: string | JwtSecretFunc
timeout?: number // In milliseconds to handle the second round trip.
callback?: boolean | number // To disconnect socket server-side without a client-side callback if no valid token.
decodedPropertyName?: string // Property to store the decoded token to.
handshake?: boolean // Used to trigger a single round trip authentication.
required?: boolean
interface AuthorizeOptions {
secret: string
}
/**
* Defines possible errors for the secret-callback.
*/
interface ISocketIOError {
readonly code: string
readonly message: string
}
interface AuthOptions extends JwtAuthOptions {
additional_auth?: (
decoded: object,
onSuccess: () => void,
onError: (err: string | ISocketIOError, code: string) => void
) => void
customDecoded?: (decoded: object) => object
encodedPropertyName: string
decodedPropertyName: string
cookie?: string
}
type ISocketIOMiddleware = (socket: Socket, fn: (err?: any) => void) => void
/**
* @description This function returns a middleware function for use with Socket.IO that authenticates a new connection.
* @param options is an object literal that contains options.
*/
export function authorize(authOptions: JwtAuthOptions): ISocketIOMiddleware {
const options: AuthOptions = Object.assign(
{
decodedPropertyName: 'decoded_token',
encodedPropertyName: 'encoded_token'
},
authOptions
)
if (
typeof options.secret !== 'string' &&
typeof options.secret !== 'function'
) {
throw new Error(
`Provided secret ${options.secret} is invalid, must be of type string or function.`
)
}
if (!options.handshake) {
return noQsMethod(options)
}
const defaults = {
success: (socket: Socket, accept: Function) => {
if (socket.request) {
accept()
} else {
accept(null, true)
}
},
fail: (error: Error, socket: Socket, accept: Function) => {
if (socket.request) {
accept(error)
} else {
accept(null, false)
export const authorize = (options: AuthorizeOptions): SocketIOMiddleware => {
const { secret } = options
return (socket, next) => {
let token: string | null = null
const authorizationHeader = socket.request.headers.authorization
if (authorizationHeader != null) {
const tokenSplitted = authorizationHeader.split(' ')
if (tokenSplitted.length !== 2 || tokenSplitted[0] !== 'Bearer') {
return next(
new UnauthorizedError('credentials_bad_format', {
message: 'Format is Authorization: Bearer [token]'
})
)
}
token = tokenSplitted[1]
}
}
const auth = Object.assign(defaults, options)
return (socket: any, accept: Function) => {
let token: any, error: any
const handshake = socket.handshake
const req = socket.request || socket
const authorization_header = (req.headers || {}).authorization
if (authorization_header) {
const parts = authorization_header.split(' ')
if (parts.length === 2) {
const scheme = parts[0]
const credentials = parts[1]
if (scheme.toLowerCase() === 'bearer') {
token = credentials
}
} else {
error = new UnauthorizedError('credentials_bad_format', {
message: 'Format is Authorization: Bearer [token]'
if (token == null) {
return next(
new UnauthorizedError('credentials_required', {
message: 'no token provided'
})
return auth.fail(error, socket, accept)
}
}
// Check if the header has to include authentication
if (options.auth_header_required && token == null) {
return auth.fail(
new UnauthorizedError('missing_authorization_header', {
message: 'Server requires Authorization Header'
}),
socket,
accept
)
}
// Get the token from handshake or query string
if (handshake && handshake.query.token) {
token = handshake.query.token
} else if (req._query && req._query.token) {
token = req._query.token
} else if (req.query && req.query.token) {
token = req.query.token
}
if (token == null) {
error = new UnauthorizedError('credentials_required', {
message: 'no token provided'
})
return auth.fail(error, socket, accept)
}
// Store encoded JWT
socket = Object.assign(socket, { [options.encodedPropertyName]: token })
const onJwtVerificationReady = (err: any, decoded: any) => {
if (err != null) {
error = new UnauthorizedError(err.code || 'invalid_token', err)
return auth.fail(error, socket, accept)
}
socket = Object.assign(socket, {
[options.decodedPropertyName]:
options.customDecoded != null
? options.customDecoded(decoded)
: decoded
})
return auth.success(socket, accept)
socket = Object.assign(socket, { encodedToken: token })
let payload: any
try {
payload = jwt.verify(token, secret)
} catch {
return next(
new UnauthorizedError('invalid_token', {
message: 'Unauthorized: Token is missing or invalid Bearer'
})
)
}
const onSecretReady = (err: any, secret: string) => {
if (err) {
error = new UnauthorizedError(err.code || 'invalid_secret', err)
return auth.fail(error, socket, accept)
}
jwt.verify(token, secret, options as any, onJwtVerificationReady)
}
getSecret(req, options.secret, token, onSecretReady)
}
}
function getSecret(
request: any,
secret: any,
token: string,
callback: Function
) {
if (typeof secret === 'function') {
if (!token) {
return callback({
code: 'invalid_token',
message: 'jwt must be provided'
})
}
const parts = token.split('.')
if (parts.length < 3) {
return callback({ code: 'invalid_token', message: 'jwt malformed' })
}
if (parts[2].trim() === '') {
return callback({
code: 'invalid_token',
message: 'jwt signature is required'
})
}
const decodedToken = jwt.decode(token, { complete: true }) as {
[key: string]: any
}
if (decodedToken == null) {
return callback({ code: 'invalid_token', message: 'jwt malformed' })
}
const arity = secret.length
if (arity === 4) {
secret(request, decodedToken.header, decodedToken.payload, callback)
} else {
// arity == 3
secret(request, decodedToken.payload, callback)
}
} else {
callback(null, secret)
}
}
function noQsMethod(options: AuthOptions): ISocketIOMiddleware {
const defaults = { required: true }
options = Object.assign(defaults, options)
return (socket: any) => {
let auth_timeout: NodeJS.Timeout | null = null
if (options.required) {
auth_timeout = setTimeout(() => {
socket.disconnect(true)
}, options.timeout ?? 5000)
}
socket.on('authenticate', (data: any) => {
if (options.required && auth_timeout != null) {
clearTimeout(auth_timeout)
}
const onError = (err: any, code: string) => {
if (err) {
code = code ?? 'unknown'
const error = new UnauthorizedError(code, {
message:
Object.prototype.toString.call(err) === '[object Object]' &&
err.message
? err.message
: err
})
let callback_timeout: NodeJS.Timeout | null = null
// If callback explicitly set to false, start timeout to disconnect socket
if (
options.callback === false ||
typeof options.callback === 'number'
) {
if (typeof options.callback === 'number') {
if (options.callback < 0) {
// If callback is negative(invalid value), make it positive
options.callback = Math.abs(options.callback)
}
}
callback_timeout = setTimeout(
() => {
socket.disconnect(true)
},
options.callback === false ? 0 : options.callback
)
}
socket.emit('unauthorized', error, () => {
if (
typeof options.callback === 'number' &&
callback_timeout != null
) {
clearTimeout(callback_timeout)
}
socket.disconnect(true)
})
return null
}
}
const token = options.cookie
? socket.request.cookies[options.cookie]
: data
? data.token
: undefined
if (token == null || typeof token !== 'string') {
return onError({ message: 'invalid token datatype' }, 'invalid_token')
}
// Store encoded JWT
socket = Object.assign(socket, { [options.encodedPropertyName]: token })
const onJwtVerificationReady = (err: any, decoded: any) => {
if (err) {
return onError(err, 'invalid_token')
}
// success handler
const onSuccess = () => {
socket = Object.assign(socket, {
[options.decodedPropertyName]: options.customDecoded
})
socket.emit('authenticated')
}
if (
options.additional_auth != null &&
typeof options.additional_auth === 'function'
) {
options.additional_auth(decoded, onSuccess, onError)
} else {
onSuccess()
}
}
const onSecretReady = (err: any, secret: string) => {
if (err != null || secret == null) {
return onError(err, 'invalid_secret')
}
jwt.verify(token, secret, options as any, onJwtVerificationReady)
}
getSecret(socket.request, options.secret, token, onSecretReady)
})
// Store decoded JWT
socket = Object.assign(socket, { decodedToken: payload })
return next()
}
}