Commit Graph

9 Commits

Author SHA1 Message Date
Damien Arrachequesne
4bd5b2339a feat: throw upon reserved event names
These events cannot be used by the end users, because they are part of
the Socket.IO public API, so using them will now throw an error
explicitly.
2020-10-13 23:02:09 +02:00
Damien Arrachequesne
83a2356648 refactor: properly delegate to the main namespace 2020-10-13 23:02:08 +02:00
Damien Arrachequesne
2875d2cfdf feat: do not reuse the Engine.IO id
In previous versions, the Socket#id attribute was equal (or derived,
for a non-default namespace) to the underlying Engine.IO id, which is
used as a mean to authenticate the user throughout the Engine.IO
session and thus is sensitive information that should be kept secret.

The problem with reusing the Engine.IO id is that users could be
tempted to transmit this id to other clients, in order to implement
private messaging for example.

So we'll now generate a new random id for each new socket.

Please note that this id will now be different from the one found in
the query parameters of the HTTP requests.
2020-10-13 23:02:07 +02:00
Damien Arrachequesne
3289f7ec37 feat: remove the implicit connection to the default namespace
In previous versions, a client was always connected to the default
namespace, even if it requested access to another namespace.

This meant that the middlewares registered for the default namespace
were triggered in any case, which is a surprising behavior for end
users.

This also meant that the query option of the Socket on the client-side
was not sent in the Socket.IO CONNECT packet for the default namespace:

```js
// default namespace: query sent in the query params
const socket = io({
  query: {
    abc: "def"
  }
});

// another namespace: query sent in the query params + the CONNECT packet
const socket = io("/admin", {
  query: {
    abc: "def"
  }
});
```

The client will now send a CONNECT packet in any case, and the query
option of the Socket is renamed to "auth", in order to make a clear
distinction with the query option of the Manager (included in the query
parameters of the HTTP requests).

```js
// server-side
io.use((socket, next) => {
  // not triggered anymore
});

io.of("/admin").use((socket, next => {
  // triggered
  console.log(socket.handshake.query.abc); // "def"
  console.log(socket.handshake.auth.abc); // "123"
});

// client-side
const socket = io("/admin", {
  query: {
    abc: "def"
  },
  auth: {
    abc: "123"
  }
});
```
2020-10-13 23:02:07 +02:00
Damien Arrachequesne
1108ede120 chore: bump socket.io-parser
Breaking change:

- the encode() method is now synchronous

Please note that the exchange [protocol][1] is left untouched and thus
stays in version 4.

Diff: https://github.com/socketio/socket.io-parser/compare/3.4.1...4.0.0

[1] https://github.com/socketio/socket.io-protocol
2020-09-28 16:07:09 +02:00
Damien Arrachequesne
424a473c22 refactor: use ES6 Maps instead of plain objects
These attributes were not part of the public API, so there's no
breaking change.
2020-09-26 01:21:51 +02:00
Damien Arrachequesne
1507b416d5 feat: remove Socket#rooms object
The value stored in the adapter will now be used, instead of
duplicating it in the Socket class.

Breaking change: Socket#rooms is now a Set instead of an object

Closes https://github.com/socketio/socket.io/issues/2890
2020-09-26 00:48:55 +02:00
Damien Arrachequesne
84437dc2a6 chore: bump socket.io-adapter
Breaking changes:

- Namespace#connected is now a Map instead of an object.

- Namespace#clients() is renamed to Namespace#allSockets() and now
returns a Promise

Diff: https://github.com/socketio/socket.io-adapter/compare/1.1.2...2.0.0
2020-09-26 00:24:54 +02:00
Damien Arrachequesne
a5581a9789 refactor: migrate to TypeScript 2020-09-25 23:41:53 +02:00