Stateless socket auth

[marshallswain]

This would optionally make feathers-socketio work the same as feathers-rest. With REST calls, you pass the token in every request in a header. Socket requests don't send headers, but it would be nice to be able to pass a client param with an accessToken and have just that single request be authenticated. This would make WebSocket-based SSR much simpler.

[Avnerus]

Hi! I tried to implement this myself and it seemed to work, but I would like to make sure I did it right. I could make a pull request after your comments.
Basically I have an alarm clock service using mongoose and with the hook:

app.service('alarms').before({
  find: [
    authHooks.queryWithCurrentUser()
  ]
});

It works statefully with socketio from the client, if I call authtenticate first with a JWT token.
I understood that if I want it to work with stateless auth (for SSR), I should add the auth hook to the stateless service. Thus it became:

app.service('alarms').before({
  find: [
    authentication.hooks.authenticate(['jwt']),
    authHooks.queryWithCurrentUser()
  ]
});

Then from node I just add {accessToken: xxxx} to my socket call (I get the token from the cookie after verifying it).
However, the authenticate hook couldn't extract the JWT token from the socket call. I noticed it builds the request for passport to extract the JWT from. But request.body gets populated with hook.data, which works only on a dedicated authentication request. On a standard request, the accessToken would be in hook.params.query. Thus I added the following line before building the request here

    if (hook.params.provider == "socketio" && !hook.data.strategy) {
        hook.data = hook.params.query;
    }

That seemed to be enough for everything to work and I can use authenticated socket requests from node to do SSR.
What do you think?
/Avner

[Avnerus]

So, it's a bit more complicated than that. I had to also make sure to delete query.accessToken after usage, because otherwise it would interfere with the query. Unfortunately that makes the experience a bit less seamless.

[daffl]

This has been done in Feathers v4 authentication.

Please see the migration guide for more information. Closing this issue in order to archive this repository. Related issues can be opened at the new code location in the Feathers main repository.