blocks|key|816071|text|使用connect-redis并将redis作为所有经过身份验证的用户的会话存储。确保在身份验证时将密钥(通常为req.sessionID)发送到客户端。让客户端将此密钥存储在cookie中。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|816072|在套接字连接时(或以后的任何时候)，从cookie中获取该密钥，并将其发送回服务器。使用此密钥获取redis中的会话信息。(获取密钥)|816073|例如：|816074|服务器端(使用redis作为会话存储)：|816075|req.session.regenerate...
res.send({rediskey:+req.sessionID});|code-block|syntax|javascript|816076|客户端：|816077|//store+the+key+in+a+cookie
SetCookie('rediskey',+<%25=+rediskey+%25>);+//http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx

//then+when+socket+is+connected,+fetch+the+rediskey+from+the+document.cookie+and+send+it+back+to+server
var+socket+=+new+io.Socket();

socket.on('connect',+function()+{
++var+rediskey+=+GetCookie('rediskey');+//http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx
++socket.send({rediskey:+rediskey});
});|816078|服务器端：|816079|//in+io.on('connection')
io.on('connection',+function(client)+{
++client.on('message',+function(message)+{

++++if(message.rediskey)+{
++++++//fetch+session+info+from+redis
++++++redisclient.get(message.rediskey,+function(e,+c)+{
++++++++client.user_logged_in+=+c.username;
++++++});
++++}

++});
});|816080|entityMap^0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|X|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Y|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|Z|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|10|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|11|8|@]|9|@]|A|$]]|$1|O|3|P|5|J|7|12|8|@]|9|@]|A|$K|L]]|$1|Q|3|R|5|6|7|13|8|@]|9|@]|A|$]]|$1|S|3|T|5|J|7|14|8|@]|9|@]|A|$K|L]]|$1|U|3|-4|5|6|7|15|8|@]|9|@]|A|$]]]|V|$]]

Use connect-redis and have redis as your session store for all authenticated users. Make sure on authentication you send the key (normally req.sessionID) to the client. Have the client store this key in a cookie.

On socket connect (or anytime later) fetch this key from the cookie and send it back to the server. Fetch the session information in redis using this key. (GET key)

Eg:

Server side (with redis as session store):

<pre class="lang-js prettyprint-override"><code>req.session.regenerate...
res.send({rediskey: req.sessionID});
</code></pre>

Client side:

<pre class="lang-js prettyprint-override"><code>//store the key in a cookie
SetCookie('rediskey', &lt;%= rediskey %&gt;); //http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx

//then when socket is connected, fetch the rediskey from the document.cookie and send it back to server
var socket = new io.Socket();

socket.on('connect', function() {
 var rediskey = GetCookie('rediskey'); //http://msdn.microsoft.com/en-us/library/ms533693(v=vs.85).aspx
 socket.send({rediskey: rediskey});
});
</code></pre>

Server side:

<pre><code>//in io.on('connection')
io.on('connection', function(client) {
 client.on('message', function(message) {

 if(message.rediskey) {
 //fetch session info from redis
 redisclient.get(message.rediskey, function(e, c) {
 client.user_logged_in = c.username;
 });
 }

 });
});
</code></pre>

blocks|key|816095|text|这应该就行了|type|unstyled|depth|inlineStyleRanges|entityRanges|data|816096|//server+side

io.sockets.on('connection',+function+(con)+{
++console.log(con.id)
})

//client+side

var+io+=+io.connect('http://...')

console.log(io.sessionid)|code-block|syntax|javascript|816097|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

this should do it

<pre><code>//server side

io.sockets.on('connection', function (con) {
 console.log(con.id)
})

//client side

var io = io.connect('http://...')

console.log(io.sessionid)
</code></pre>

blocks|key|1030999|text|我知道这有点老了，但是对于未来的读者来说，除了解析cookie和从存储中检索会话的方法之外(例如：passport.socketio+)，您也可以考虑基于令牌的方法。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1031000|在本例中，我使用了非常标准的JSON+Web令牌。您必须向客户端页提供令牌，在本例中，假设有一个身份验证端点返回JWT：|1031001|var+jwt+=+require('jsonwebtoken');
//+other+requires

app.post('/login',+function+(req,+res)+{

++//+TODO:+validate+the+actual+user+user
++var+profile+=+{
++++first_name:+'John',
++++last_name:+'Doe',
++++email:+'john@doe.com',
++++id:+123
++};

++//+we+are+sending+the+profile+in+the+token
++var+token+=+jwt.sign(profile,+jwtSecret,+{+expiresInMinutes:+60*5+});

++res.json({token:+token});
});|code-block|syntax|javascript|1031002|现在，您的socket.io服务器可以进行如下配置：|1031003|var+socketioJwt+=+require('socketio-jwt');

var+sio+=+socketIo.listen(server);

sio.set('authorization',+socketioJwt.authorize({
++secret:+jwtSecret,
++handshake:+true
}));

sio.sockets
++.on('connection',+function+(socket)+{
+++++console.log(socket.handshake.decoded_token.email,+'has+joined');
+++++//socket.on('event');
++});|1031004|socket.io-jwt中间件需要查询字符串中的令牌，因此在客户端，您只需在连接时附加它：|1031005|var+socket+=+io.connect('',+{
++query:+'token='+%2B+token
});|1031006|我写了一个关于这个方法和cookies+here的更详细的解释。|1031007|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/jfromaniello/passport.socketio|1|http://blog.auth0.com/2014/01/15/auth-with-socket-io/^0|1D|H|0|0|0|0|0|0|0|0|K|4|1|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]]|C|$]]|$1|D|3|E|5|6|7|18|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|19|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|1A|8|@]|9|@]|C|$]]|$1|M|3|N|5|H|7|1B|8|@]|9|@]|C|$I|J]]|$1|O|3|P|5|6|7|1C|8|@]|9|@]|C|$]]|$1|Q|3|R|5|H|7|1D|8|@]|9|@]|C|$I|J]]|$1|S|3|T|5|6|7|1E|8|@]|9|@$A|1F|B|1G|1|1H]]|C|$]]|$1|U|3|-4|5|6|7|1I|8|@]|9|@]|C|$]]]|V|$W|$5|X|Y|Z|C|$10|11]]|12|$5|X|Y|Z|C|$10|13]]]]

I know this is bit old, but for future readers in addition to the approach of parsing cookie and retrieving the session from the storage (eg. <a href="https://github.com/jfromaniello/passport.socketio" rel="noreferrer">passport.socketio</a> ) you might also consider a token based approach.

In this example I use JSON Web Tokens which are pretty standard. You have to give to the client page the token, in this example imagine an authentication endpoint that returns JWT:

<pre><code>var jwt = require('jsonwebtoken');
// other requires

app.post('/login', function (req, res) {

 // TODO: validate the actual user user
 var profile = {
 first_name: 'John',
 last_name: 'Doe',
 email: 'john@doe.com',
 id: 123
 };

 // we are sending the profile in the token
 var token = jwt.sign(profile, jwtSecret, { expiresInMinutes: 60*5 });

 res.json({token: token});
});
</code></pre>

Now, your socket.io server can be configured as follows:

<pre><code>var socketioJwt = require('socketio-jwt');

var sio = socketIo.listen(server);

sio.set('authorization', socketioJwt.authorize({
 secret: jwtSecret,
 handshake: true
}));

sio.sockets
 .on('connection', function (socket) {
 console.log(socket.handshake.decoded_token.email, 'has joined');
 //socket.on('event');
 });
</code></pre>

The socket.io-jwt middleware expects the token in a query string, so from the client you only have to attach it when connecting:

<pre><code>var socket = io.connect('', {
 query: 'token=' + token
});
</code></pre>

I wrote a more detailed explanation about this method and cookies <a href="http://blog.auth0.com/2014/01/15/auth-with-socket-io/" rel="noreferrer">here</a>.

I am trying to use Socket.IO in Node.js, and am trying to allow the server to give an identity to each of the Socket.IO clients. As the socket code is outside the scope of the http server code, it doesn't have easy access to the request information sent, so I'm assuming it will need to be sent up during the connection. What is the best way to

1) get the information to the server about who is connecting via Socket.IO

2) authenticate who they say they are (I'm currently using Express, if that makes things any easier)

Socket.IO Authentication

身份验证

中间件

服务器

JSON

我正在尝试在Node.js中使用Socket.IO，并尝试允许服务器为每个Socket.IO客户端提供一个标识。因为套接字代码不在http服务器代码的范围内，所以它不容易访问发送的请求信息，所以我假设它需要在连接期间发送。最好的方法是什么1)向服务器获取谁在通过Socket.IO连接的信息2)验证他们所说的身份(我目前...

问Socket.IO身份验证
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Socket.IO身份验证EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Socket.IO身份验证
EN