Anyone can send message impersonating anyone

[aaayushsingh]

socket.on('private message',function(msg){
            console.log('message  :'+msg.split("#*@")[0]);
            models.messages.create({
                "message":msg.split("#*@")[1],
                "sender" :msg.split("#*@")[2],
                "reciever":msg.split("#*@")[0],
                "date" : new Date()});
            io.to(users[msg.split("#*@")[0]]).emit('private message', msg);
        });

The above msg is coming from frontend and thus anyone can impersonate anyone by changing the string they are sending from the frontend

[Chr728]

@aaayushsingh is this issue solved ? or its possible I look at it ?

[aaayushsingh]

This is a very poor implementation of using sockets for messaging. I ended up making my own wrapper using ioredis and passportjs for auth.

[Chr728]

hello, so the issue is already solved and you don't need my construction help ? christina

…

On Mon, Jun 6, 2022 at 9:44 AM Ayush Singh ***@***.***> wrote: This is a very poor implementation of using sockets for messaging. I ended up making my own wrapper using ioredis and passportjs for auth. — Reply to this email directly, view it on GitHub <#3 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOJV4ICUJWLCKB5CL2XLCOLVNX6CXANCNFSM4F7VDQNQ> . You are receiving this because you commented.Message ID: ***@***.***>