title: How to secure a private socket.io room?
body: <p>I am wondering if this is the correct way to go about securing a socket.io room. Currently these are the steps that I am taking to ensure a user ends up in a private room, now I need to make sure the user gets authenticated before he is able to join.</p>
  
  <ol>
  <li>A client connects to my <code>socket.io</code> server by calling <code>io.connect</code> and passing along the room he wants to join.</li>
  <li>Client will be subscribed to the room and waits for emit of a message.</li>
  <li><code>socket_write</code> sends a <code>json_encoded</code> object to my server which holds a data property and the room to which this data will be sent.</li>
  <li>My server receives the data through <code>socket.on</code> and emits the data to the given room where the client is listening.</li>
  <li>The client will receive the proper information meant for him only.</li>
  </ol>
  
  <p><strong>My client code:</strong></p>
  
  <pre><code>var socket = io.connect('http://localhost:8000');
  socket.on('connect', function() {
     socket.emit('room', window.location.href);
  });
  </code></pre>
  
  <p><strong>The server:</strong></p>
  
  <pre><code>const server = net.createServer((socket) =&gt; {
      // The event that fires on PHP's socket_write.
      socket.on('data', (msg) =&gt; {
          const data = JSON.parse(msg);
  
          io.sockets.in(data.room).emit('log', data.html.toString().trim());
      });
  }).listen(5600);
  </code></pre>
  
  <p><strong>The <code>on</code> connection event of my server:</strong></p>
  
  <pre><code>io.on('connection', function (socket) {
      // A client will trigger this event and pass their window.location.href(room) as room identifier.
      socket.on('room', function(room) {
          socket.join(room);
      });
  });
  </code></pre>
  
  <p><strong>How I write to my socket.io server:</strong></p>
  
  <pre><code>$data = [
      'html' =&gt; 'test',
      'room' =&gt; 'http://app.dev/stephan-v/app-test'
  ];
  
  $json = json_encode($data);
  
  socket_write($this-&gt;socket, $json, strlen($json));
  </code></pre>
  
  <p>This is my implementation of a private websocket message but of course this is not secure. If somebody knows the name of the room that person could easily listen in on the emitted messages.</p>
  
  <p>Since the <code>socket.join</code> can only take place on my server I guess the only place to authentication is at that point? </p>
  
  <p>So instead of simply passing along the room I guess I should also pass in data to authenticate the user. And at that point make an AJAX requests from my <code>node</code> server to my <code>PHP</code> backend?</p>
  
  <p>Obviously I do not want to send a plain password and username over the wire so I have been reading up on JSON web tokens. I guess you need to:</p>
  
  <ol>
  <li>send a JWT to the <code>node</code> server at the point of connection(along with which room to join, which I am currently doing).</li>
  <li>Make an AJAX requests from my <code>node.js</code> server to my <code>PHP</code> backend on an authentication route.</li>
  <li>Only let the user join the room if that user gets authenticated.</li>
  </ol>
  
  <p>Sorry for the long post but there are a lot of components involved in this so I am hoping someone could confirm this workflow and perhaps give me some tips/pointers.</p>
  
  <p>I would prefer not to install something like Redis at the moment because although it is a nice bridge between the frontend/backend it feels like overkill right now and I would like to understand this all at a more basic level.</p>