Authorizing

Authorization

Socket.IO has support has for 2 different authorization functions. One is applied globally during the handshaking / initialization process and the other can be applied on different namespaces. Global and namespace based authorization can be used together or separately from each other. The only thing they share is the same handshakeData object.

But before we dive deeper in to the different authorization methods, it might be wise to know a bit more about the handshaking process.

Handshaking

When a client wants to establish a connection with Socket.IO server it needs to a pass a handshaking step first. The handshaking is done by a XHR request or JSONP request if it the server communication is cross domain. During this handshaking step Socket.IO will capture the headers and other pieces of data from the request to generate a handshakeData object. This is done for two reasons:

1. During authorization you might want to inspect the headers or ip address of the connecting client and base your authorization decision on that.
2. Not all transports send headers when they establish a connection with the Socket.IO server, so we store the handshakeData internally so you can still access it after the user passed the handshake. For example you can reuse this data to read out cookies from the headers and initiate the Express sessions for socket connections.

The handshakeData object contains the following information:

{
 , headers: req.headers      // the headers that where send with this request
 , time: (new Date) +''      // date time of the connection
 , address: socket.address() // location and port object
 , xdomain: !!headers.origin // was it a cross domain request
 , secure: socket.secure     // https connection?
}

The address is the result of socket.address().