title: When to handle Socket.io notifications?
body: <p>I am developing an IOS social application that is written in <code>SWIFT</code>.</p>
  
  <p>The backend is <code>PHP, MySQL</code> (for event handling), + a bit of <code>NodeJS, Socket.io</code> (for realtime chat and notifications)</p>
  
  <hr>
  
  <p>I have made the chat successfully:</p>
  
  <p>When the user sends a message the Socket.io server handles it the following way:</p>
  
  <ul>
  <li>it inserts the datas to the database</li>
  <li>if successful then emits the message to all the participant users</li>
  </ul>
  
  <p><em>/ so for this the backend is only the Socket.io server, which handles the database aswell</em></p>
  
  <hr>
  
  <p>Works fine.</p>
  
  <p>But then there are events that are not meant to be real time, but still I want to send a notification to the given user with Socket.io</p>
  
  <blockquote>
    <p>for example: if a post has been liked, then send a noti to the posts owner</p>
  </blockquote>
  
  <p>I have already written the PHP files for saving the like in the database, but</p>
  
  <p><strong>How should I do the notification part, safe?</strong></p>
  
  <hr>
  
  <p><strong>I have came up with 3 ideas:</strong></p>
  
  <blockquote>
    <ol>
    <li>The app sends a web request to my PHP+MySQL backend, it handles the data there, then after returning back "success", the application (SWIFT) sends a notification to the post owner <em>(via Socket.io XCode pod)</em></li>
    </ol>
  </blockquote>
  
  <pre><code>func likePost(postId : Int, completion: @escaping (ActionResult?)-&gt;()){
  
          let connectUrl = URL(string: appSettings.url + "/src/main/like.php")
          var request = URLRequest(url: connectUrl!)
          request.httpMethod = "POST"
          let postString = "userId=\(userId)&amp;session=\(session)&amp;pId=\(postId)"
          request.httpBody = postString.data(using: String.Encoding.utf8)
  
  
          let task = URLSession.shared.dataTask(with: request) {
              (data: Data?, response: URLResponse?, error: Error?) in
  
              if error != nil {
                  return completion(ActionResult(type: 0, code: 0, title: "error", message: "something went wrong"))
              }
              do {
  
                  let responseJson = try JSONSerialization.jsonObject(with: data!, options: [])
                  if let responseArray = responseJson as? [String: Any] {
  
                      let responseStatus = responseArray["status"] as? String
                      let responseTitle = responseArray["title"] as? String
                      let responseMessage = responseArray["message"] as? String
  
  
                      if responseStatus != "1" {
                          return completion(ActionResult(type: 0, code: 0, title: "error", message: "something went wrong"))
                      }
  
                      // SUCCESS, SEND NOTI WITH SOCKET.IO
  
                      socket.emit("notification_likedPost", ["postId": postId)
  
                      return completion(ActionResult(type: 1, title: "success", message: "yay"))
  
                  }
              } catch {
                  return completion(ActionResult(type: 0, code: 0, title: "error", message: "something went wrong"))
              }
          }
          task.resume()
      }
  </code></pre>
  
  <blockquote>
    <ol start="2">
    <li>same, but after returning back "success" from the PHP, itself (the PHP file) handles the Socket.IO notification emitting as well <strong><em>(I think this is not possible, I haven't found any PHP->Socket.io plugins..)</em></strong></li>
    </ol>
  </blockquote>
  
  <p>-</p>
  
  <blockquote>
    <ol start="3">
    <li>The app does not send anything to my web PHP+MySQL file, instead it sends the whole "like" process to my NodeJs, Socket.IO server, it handles it there, saves it to the database, then emits the notifications <strong><em>(Just like the real time chat part, but this would be a lot work because I have already written all the other code in PHP files)</em></strong></li>
    </ol>
  </blockquote>
  
  <hr>
  
  <p><strong>The first case is the most ideal for me</strong>, but I am scared that it would be hackable..</p>
  
  <p>Because if I do it the first way, the backend NodeJs+Socket.io server won't check if the liking process was successful (because it was checked client-sided)</p>
  
  <p>so it is likely that anyone could send fake "post like" notifications, like a billion times.</p>
  
  <hr>
  
  <p>Then maybe the second option would be great as well, so that back-end handles both checking, and notification sending, <strong>but sadly there's no Socket.io plugin for PHP</strong></p>