  'test authorization gets handshake data': function (done) {
    var port = ++ports
      , io = sio.listen(port)
      , cl = client(port);

    io.configure(function () {
      function auth (data, fn) {
        data.query.should.have.foo;
        data.query.foo.should.eql('bar');
        fn(null, false);
      };

      io.set('authorization', auth);
    });

    cl.get('/socket.io/{protocol}/?foo=bar', function (res, data) {
      res.statusCode.should.eql(403);
      data.should.match(/handshake unauthorized/);

      cl.end();
      io.server.close();
      done();
    });
  },
The software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.