node.js - 从套接字 io 访问 Express session

Question

我的问题是关于获取我通过express-handlebars发送查看的用户名val。在此聊天应用程序中，用户名可以通过 html 代码访问，并且可以更改。如果有人更改了 h4 标签内容的用户名(从 John Doe 更改为 Doe John)，则会影响所有客户端。我还使用 Express-Session 和 mongostore 来存储 session ，并且我知道如果没有 req，我无法访问 session 。那么，您提出什么方案来解决这个问题？(参加 session )提前致谢。

这是客户端

  <h4 id="username">{{username}}</h4>
    <div class="chat">
      <ul class="chat-box"></ul>
    </div>
    <div class="chat-user">
      <form io="form-chat" class="form-inline">
        <div class="form-group">
            <input type="text" class="form-controll" id="text-chat" name="text-chat" value="">
        </div>
        <button>send`enter code here`</button>
      </form>

那是服务器端

function socket(io) {

    io.on('connection', function(socket) {
        socket.on('chat message', function(msg) {
            console.log(splitUsername[0]);*/
            io.emit('chat message', msg);
        });
    });
}

module.exports = socket;

Answer 1

永远不要相信客户端(在服务器端存储重要变量，而不是依赖客户端)

在能够使用聊天之前，我会进行一个简单验证(选择用户名)协议(protocol)。

const _onlineUsernames = {};
const MAX_USERNAME_LENGTH = 16;
io.on('connection', function(socket) {
 //.: Login (Pick Username)
 socket.on('enter',function(username){
  if(username){ //did we really receive a username?
   if(username.length!=0 && username.length<=MAX_USERNAME_LENGTH){
    if(!_onlineUsernames[username]){
    //username not in use, add to online list & verify :
    _onlineUsernames[username] = {sid:socket.id}; 
    socket.chat_verified = true; //used to verify username has been picked
    socket.chat_username = username; //store in the socket
    }else{socket.emit('error', 'username currently in use');}
   }else{socket.emit('error', 'length of username supplied');}
  }else{socket.emit('error', 'no username supplied');}
 });
 //.: Chat Logic
 socket.on('chat message', function(msg) {
  if(socket.chat_verified){ // Check if the user is verified (previously picked username)
    console.log(socket.chat_username);
    // Here, I would do some escaping/sanitation before emiting the message, 
    // mainly to prevent client-to-client injection (sanitation/escaping can be done in the client-side instead)
    io.emit('chat message', msg);
  }else{ socket.emit('error', 'chat_verification_required'); }
 });
 //.: Login (Pick Username)
 socket.on('disconnect',function(){
  // Check if disconnected user was verified (picked username)
  if(socket.chat_verified){ delete _onlineUsernames[socket.chat_username]; }//username is free to be used again
 });
});

客户端在验证用户名(套接字“输入”事件)之前将无法使用聊天

如果您担心安全性，您还应该清理/转义客户端的消息。 示例:客户端发送以下消息 ( <script>alert('injected js!);</script> )

<小时/>

编辑:(问题特别询问从套接字访问 session )

使用 express-session-socket.io 中间件在 socket.io 中公开快速 session 对象(类似于我在套接字中存储用户名的做法)

代码示例:简单(因为您可能已经定义了 sessionStore)

io.use(require('express-session-socket.io')(sessionStore, 'secret', function (err, session, socket, next) {
    if (err) next(err);
    socket.session = session;
    next();
}));