750 Commits

Author SHA1 Message Date
Damien Arrachequesne
d30630ba10 fix: add a noop handler for the error event
Backported from main: 15af22fc22
2024-06-19 10:46:29 +02:00
Damien Arrachequesne
f223178eb6 fix: prevent the socket from joining a room after disconnection
Calling `socket.join()` after disconnection would lead to a memory
leak, because the room was never removed from the memory:

```js
io.on("connection", (socket) => {
  socket.disconnect();
  socket.join("room1"); // leak
});
```

Related:

- https://github.com/socketio/socket.io/issues/4067
- https://github.com/socketio/socket.io/issues/4380

Backported from 18f3fdab12
2022-06-26 08:54:51 +02:00
Damien Arrachequesne
226cc16165 fix: only set 'connected' to true after middleware execution
The Socket instance is only considered connected when the "connection"
event is emitted, and not during the middleware(s) execution.

```js
io.use((socket, next) => {
  console.log(socket.connected); // prints "false"
  next();
});

io.on("connection", (socket) => {
  console.log(socket.connected); // prints "true"
});
```

Related: https://github.com/socketio/socket.io/issues/4129

Backported from 02b0f73e2c
2022-06-26 08:46:28 +02:00
Damien Arrachequesne
05e1278cfa fix: fix race condition in dynamic namespaces
Using an async operation with `io.use()` could lead to the creation of
several instances of a same namespace, each of them overriding the
previous one.

Example:

```js
io.use(async (nsp, auth, next) => {
  await anOperationThatTakesSomeTime();
  next();
});
```

Related: https://github.com/socketio/socket.io/issues/4136

Backported from 9d86397243
2022-06-26 08:41:16 +02:00
Damien Arrachequesne
22d4bdf00d fix: ignore packet received after disconnection
Related: https://github.com/socketio/socket.io/issues/3095

Backported from 494c64e44f
2022-06-26 08:35:42 +02:00
Damien Arrachequesne
a169050947 revert: fix(security): do not allow all origins by default
This reverts commit f78a575f66.

This commit contains a breaking change which deviates from semver,
which we try to follow as closely as possible. That's why this change
is reverted and we will rather suggest users to upgrade to v3.

Related: https://github.com/socketio/socket.io/discussions/3741
2021-01-07 10:51:55 +01:00
Damien Arrachequesne
f78a575f66 fix(security): do not allow all origins by default
BREAKING CHANGE: previously, all origins were allowed by default, which
meant that a Socket.IO server sent the necessary CORS headers
(`Access-Control-Allow-xxx`) to any domain by default.

Please note that you are not impacted if:

- you are using Socket.IO v2 and the `origins` option to restrict the list of allowed domains
- you are using Socket.IO v3 (disabled by default)

This commit also removes the support for '*' matchers and protocol-less
URL:

```
io.origins('https://example.com:443'); => io.origins(['https://example.com']);
io.origins('localhost:3000');          => io.origins(['http://localhost:3000']);
io.origins('http://localhost:*');      => io.origins(['http://localhost:3000']);
io.origins('*:3000');                  => io.origins(['http://localhost:3000']);
```

To restore the previous behavior (please use with caution):

```js
io.origins((_, callback) => {
  callback(null, true);
});
```

See also:

- https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
- https://socket.io/docs/v3/handling-cors/
- https://socket.io/docs/v3/migrating-from-2-x-to-3-0/#CORS-handling

Thanks a lot to https://github.com/ni8walk3r for the security report.
2021-01-04 22:34:09 +01:00
Sebastiaan Marynissen
d33a619905 fix: properly overwrite the query sent in the handshake
The `query` option of the Manager had the priority over the one of the
Socket instance, which meant updating the Socket#query object on the
client-side was not reflected in the Socket#handshake object on the
server-side.

Please note that the behavior of the `query` option is still a bit
weird in Socket.IO v2, as it only applies to non-default namespace.
This is fixed in v3:

- https://socket.io/docs/v3/migrating-from-2-x-to-3-0/#Add-a-clear-distinction-between-the-Manager-query-option-and-the-Socket-query-option
- https://socket.io/docs/v3/middlewares/#Sending-credentials

Fixes https://github.com/socketio/socket.io/issues/3495
2021-01-04 11:34:24 +01:00
Markko Legonkov
b00ae50be6 [feat] Add cache-control header when serving the client source (#2907) 2018-11-20 08:02:04 +01:00
Antonio
a7fbd1ac4a [fix] Throw an error when trying to access the clients of a dynamic namespace (#3355)
Accessing the clients of a dynamic namespace throws because doing `io.of(/your-regex/g)` returns a namespace with no adapter and the clients methods tries to access `namespace.adapter.clients`.
2018-11-20 07:40:11 +01:00
Sleiman Sleiman
1decae341c [feat] Add local flag to the socket object (#3219)
To match the behaviour on the namespace (see #2628).
2018-04-27 13:03:25 +02:00
Damien Arrachequesne
ac945d1eba [feat] Add support for dynamic namespaces (#3195)
This follows #3187, with a slightly different API.

A dynamic namespace can be created with:

```js
io.of(/^\/dynamic-\d+$/).on('connect', (socket) => { /* ... */ });
```
2018-03-29 23:08:08 +02:00
Damien Arrachequesne
1f1d64bab6 [fix] Include the protocol in the origins check (#3198)
Previously, the protocol was not taken in account, which caused the following behaviour:

```js
io.origins('https://foo.example.com:443'); // ok as a string
io.origins(['https://foo.example.com:443'); // not ok as an array
```

Fixes #3190
2018-03-10 08:56:42 +01:00
Damien Arrachequesne
f4fc517e0f [fix] Properly emit 'connect' when using a custom namespace (#3197)
When using a custom namespace with a middleware, the client did not receive the 'connect' event.

Fixes #3082
2018-03-10 08:51:22 +01:00
Damien Arrachequesne
c0c79f019e [feat] Add support for dynamic namespaces (#3187) 2018-03-01 00:22:16 +01:00
Damien Arrachequesne
f48a06c040 [feat] Add a 'binary' flag (#3185)
So that the call to the `has-binary` method can be skipped. Usage:

```
// with binary data
socket.binary(true).emit("binary", obj);

// without binary data
socket.binary(false).emit("string", obj);

// call to hasBin
socket.emit("guess", obj);
```
2018-02-28 23:00:16 +01:00
Damien Arrachequesne
dd69abbeee [fix] Reset rooms object before broadcasting from namespace (#3039) 2017-08-26 07:36:26 +02:00
Damien Arrachequesne
1f0e64a6da [fix] Do not throw when receiving an unhandled error packet (#3038) 2017-08-26 07:35:57 +02:00
Damien Arrachequesne
db0c69969e [fix] Reset rooms object before broadcasting (#2970)
It seems packets could be delivered to wrong room in some case, if the
_rooms array was not reset before the next emit.
2017-06-12 14:01:35 +02:00
Damien Arrachequesne
94df7bcdfd [fix] Fix middleware initialization (#2969)
Fix "TypeError: Cannot convert undefined or null to object" when a
middleware is added before the engine is properly attached.
2017-06-12 14:00:48 +02:00
Damien Arrachequesne
2b10f1b3a4 [docs] Update webpack example (#2960) 2017-06-03 13:53:03 +02:00
Damien Arrachequesne
2b216902e1 [fix] Fix timing issues with middleware (#2948)
Using a middleware could previously lead to a connecting client
receiving a connect event from the server before the server triggers
its own connect event.
2017-05-22 13:01:59 +02:00
Damien Arrachequesne
a0056904c1 [fix] Update path of client file (#2934) 2017-05-09 01:36:40 +02:00
Damien Arrachequesne
87b06ad362 [feat] Move binary detection to the parser (#2923) 2017-04-25 00:38:07 +02:00
Damien Arrachequesne
01a4623613 [feat] Allow to join several rooms at once (#2879) 2017-02-26 09:15:32 +01:00
Damien Arrachequesne
5ae06e6285 [chore] Bump socket.io-adapter to version 1.0.0 (#2867) 2017-02-17 07:33:43 +01:00
Damien Arrachequesne
54ff591b07 [feature] Merge Engine.IO and Socket.IO handshake packets (#2833) 2017-02-01 15:28:14 +01:00
Damien Arrachequesne
3b92cc2b26 [feature] Allow the use of custom parsers (#2829) 2017-01-24 07:10:19 +01:00
Antoine LUCAS
3b5f4339a7 [fix] Use path.resolve by default and require.resolve as a fallback (#2797)
Browserify doesn't support require.resolve, and as a consequence, makes nexe fail the compilation. This PR attempts to get the path of the socket.io-client file via path.resolve and falls back to the original require.resolve if this file cannot be found.
2017-01-22 07:21:45 +01:00
Tom Atkinson
2258a6a6e3 [fix] Properly close the connection on error (#2681) 2017-01-16 08:29:11 +01:00
Tom Atkinson
ad658b8cc2 [perf] Use shared instance of the encoder (#2825) 2017-01-16 08:25:52 +01:00
Tom Atkinson
e24434a0a0 [perf] Reset properties instead of deleting them (#2826)
Deleting properties is a v8 'optimization killer'
2017-01-16 08:23:22 +01:00
Ian Bro
a27802e19e [fix] Prevent null from being accepted as argument (#2606) 2016-12-30 16:22:16 +01:00
Gatsbill
c46d4481bd [perf] micro-optimisations (#2793) 2016-12-30 16:18:09 +01:00
Serhii Sol
1e31769062 [fix] Fixes socket.use error packet (#2772)
* fix(socket): Fixes socket.use error packet which drops nodejs due to nuances of Nodejs' EventEmitter

* fix(socket): Fixes missing error event on socket

* fix(socket): test fix, should listen for clientSocket instead of server socket

* minor update
2016-12-01 02:25:13 +01:00
Damien Arrachequesne
3c98130f15 [chore] Update client location and serve minified file (#2766)
Following https://github.com/socketio/socket.io-client/pull/1025, the
output files are now generated in the dist directory.
2016-11-27 08:24:27 +01:00
Tal Beja
955e5e0d91 [feature] Add a local flag (#2628)
That new flag will prevent the adapter (redis) from publishing the emit to the pub/sub server.

When several instances of a server receive the same event from a third party (not from a client), each server instance broadcasts the event to all his clients. With the local flag, and the change in the redis adapter, each server instance send the event only to his client, so each client receive only one unique event.
2016-11-24 23:44:52 +01:00
Zhu Liang
0ef55b26d4 [feature] serve sourcemap for socket.io-client (#2482) 2016-11-24 23:39:43 +01:00
Jérémy Lal
d48f848bb4 [docs] Comment connected socket availability for adapters (#2081) 2016-11-23 15:00:07 +01:00
Luca Tabone
ff2c15de68 [perf] Minor code optimizations (#2219) 2016-11-18 02:03:06 +01:00
Julian Grinblat
4c5dbd8824 [fix] Don't drop query variables on handshake (#2745)
Parameters passed during handshake, such as tokens, were being dropped.
2016-11-16 01:17:19 +01:00
mhmeadows63
e14a10b7ce [feature] add support for Server#close(callback) (#2748) 2016-11-15 21:52:56 +01:00
Alex
5a123beea5 [feature] Add support for socket middleware (#2306) 2016-11-05 01:51:29 +01:00
Julian Grinblat
e9f980c475 [feature] Add support for all event emitter methods (#2601) 2016-11-05 01:14:21 +01:00
Atanas Palavrov
04fc0f3677 [feature] Loading client script on demand. (#2567)
Support for the serving of the client script mess with packagers like
browserify, webpack. Especcialy in projects where it is not used at all.
This patch is workaround to avoid that problem in the cases when client
script is not served.
2016-10-30 14:22:00 +01:00
Kenton Varda
d026c00d05 [fix] Make ETag header comply with standard. (#2603)
The standard says that an ETag must be surrounded in double quotes:

https://tools.ietf.org/html/rfc7232#section-2.3

Although browsers tend to be lenient, omitting the quotes can confuse/break some kinds of proxies and other tools that demand compliant formatting. For example, Sandstorm.io enforces strict HTTP usage for security reasons and will block responses with invalid ETags.
2016-10-30 14:19:00 +01:00
Feram Bot
ccd3376627 [docs] Minor fixes (#2526) 2016-10-21 03:21:45 +02:00
Tom Atkinson
e60bd5a4da [fix] Avoid swallowing exceptions thrown by user event handlers (#2682) 2016-10-21 03:16:36 +02:00
davidlondono
b8c60506a6 [docs] Fix JSDoc of optional parameters (#2465)
Making proper optional Docs for socketIO
2016-10-21 03:02:59 +02:00
Damien Arrachequesne
43d9a4b55d [feature] Add a 'disconnecting' event to access to socket.rooms upon disconnection (#2332) 2016-10-06 23:23:26 +02:00